Passport-controlled firewall

1. A method for dynamically modifying rules in a firewall infrastructure, said method comprising:

receiving, by one or more processors, a signed passport comprising a hash value that includes a heart-beat time-out interval and a firewall rule, said one or more processors being hardware processors;

encrypting, by the one or more processors, the signed passport based on a public key certificate registered with a trusted signer;

generating, by the one or more processors, a trigger signal within the heart-beat time-out interval;

transmitting, by the one or more processors, the signed passport and the trigger signal within the heart-beat time-out interval to a border control agent of a firewall in the firewall infrastructure;

in response to receiving, by the one or more processors from the border control agent, a continuous confirmation of the firewall rule within a time interval shorter than the heart-beat time-out interval, modifying, by the one or more processors, the firewall according to the firewall rule;

in response to determining, by the one or more processors, that the trigger signal was not received by the border control agent within the heart-beat time-out interval, resetting, by the one or more processors, the firewall rule.

2. The method of claim 1 , said receiving comprising receiving an application code, said signed passport further comprising a first application hash value, said method further comprising:

authenticating, by said one or more processors, the received passport;

hashing, by said one or more processors, the received application code, resulting in a second application hash value; and

validating, by the one or more processors, the received first application hash value and the second application hash value as being equal,

wherein said transmitting the signed passport and the trigger signal to the border control agent is in response to said authenticating and said validating.

3. The method of claim 2 , said method further comprising:

communicating, by the one or more processors with the application code, through the modified firewall.

4. The method of claim 1 , said method further comprising:

in response to a period of inactivity, closing, by the one or more processors, the firewall.

5. The method of claim 1 , said receiving the signed passport comprising receiving the signed passport during a first time period at a requestor module on a server, said method further comprising:

identifying, by the one or more processors during a second time period, the passport as unsigned; and

in response to a determination, by the or more processors, of an unsecured communication channel between the requestor module and the border control agent:

identifying, by the one or more processors, a signing of the unsigned passport by the requestor module;

encrypting, by the one or more processors, the signed passport with a public key of the border control agent; and

transmitting, by the one or more processors, the encrypted passport through the unsecured communication channel.

6. The method of claim 1 , wherein said encrypting comprising utilizating an asymmetrical encryption method.

7. A computer program product, comprising one or more computer readable hardware storage devices having computer readable program code stored therein, said program code containing instructions executable by one or more processors to implement a method for dynamically modifying rules in a firewall infrastructure, said method comprising:

receiving, by the one or more processors, a signed passport comprising a hash value that includes a heart-beat time-out interval and a firewall rule, said one or more processors being hardware processors;

encrypting, by the one or more processors, the signed passport based on a public key certificate registered with a trusted signer;

generating, by the one or more processors, a trigger signal within the heart-beat time-out interval;

transmitting, by the one or more processors, the signed passport and the trigger signal within the heart-beat time-out interval to a border control agent of a firewall in the firewall infrastructure;

in response to receiving, by the one or more processors from the border control agent, a continuous confirmation of the firewall rule within a time interval shorter than the heart-beat time-out interval, modifying, by the one or more processors, the firewall according to the firewall rule;

in response to determining, by the one or more processors, that the trigger signal was not received by the border control agent within the heart-beat time-out interval, resetting, by the one or more processors, the firewall.

8. The computer program product of claim 7 , said receiving comprising receiving an application code, said signed passport further comprising a first application hash value, said method further comprising:

authenticating, by said one or more processors, the received passport;

hashing, by said one or more processors, the received application code, resulting in a second application hash value; and

validating, by the one or more processors, the received first application hash value and the second application hash value as being equal,

wherein said transmitting the signed passport and the trigger signal to the border control agent is in response to said authenticating and said validating.

9. The computer program product of claim 8 , said method further comprising:

communicating, by the one or more processors with the application code, through the modified firewall.

10. The computer program product of claim 7 , said method further comprising:

in response to a period of inactivity, closing, by the one or more processors, the firewall.

11. The computer program product of claim 7 , said receiving the signed passport comprising receiving the signed passport during a first time period at a requestor module on a server, said method further comprising:

identifying, by the one or more processors during a second time period, the passport as unsigned; and

in response to a determination, by the or more processors, of an unsecured communication channel between the requestor module and the border control agent:

identifying, by the one or more processors, a signing of the unsigned passport by the requestor module;

encrypting, by the one or more processors, the signed passport with a public key of the border control agent; and

transmitting, by the one or more processors, the encrypted passport through the unsecured communication channel.

12. The computer program product of claim 7 , wherein said encrypting comprising utilizating an asymmetrical encryption method.

13. A computer system, comprising one or more processors, one or more memories, and one or more computer readable hardware storage devices, said one or more storage device containing program code executable by the one or more processors via the one or more memories to implement a method for dynamically modifying rules in a firewall infrastructure, said method comprising:

receiving, by the one or more processors, a signed passport comprising a hash value that includes a heart-beat time-out interval and a firewall rule, said one or more processors being hardware processors;

encrypting, by the one or more processors, the signed passport based on a public key certificate registered with a trusted signer;

generating, by the one or more processors, a trigger signal within the heart-beat time-out interval;

transmitting, by the one or more processors, the signed passport and the trigger signal within the heart-beat time-out interval to a border control agent of a firewall in the firewall infrastructure;

in response to receiving, by the one or more processors from the border control agent, a continuous confirmation of the firewall rule within a time interval shorter than the heart-beat time-out interval, modifying, by the one or more processors, the firewall according to the firewall rule;

in response to determining, by the one or more processors, that the trigger signal was not received by the border control agent within the heart-beat time-out interval, resetting, by the one or more processors, the firewall.

14. The computer system of claim 13 , said receiving comprising receiving an application code, said signed passport further comprising a first application hash value, said method further comprising:

authenticating, by said one or more processors, the received passport;

hashing, by said one or more processors, the received application code, resulting in a second application hash value; and

validating, by the one or more processors, the received first application hash value and the second application hash value as being equal,

wherein said transmitting the signed passport and the trigger signal to the border control agent is in response to said authenticating and said validating.

15. The computer system of claim 14 , said method further comprising:

communicating, by the one or more processors with the application code, through the modified firewall.

16. The computer system of claim 13 , said method further comprising:

in response to a period of inactivity, closing, by the one or more processors, the firewall.

17. The computer system of claim 13 , said receiving the signed passport comprising receiving the signed passport during a first time period at a requestor module on a server, said method further comprising:

identifying, by the one or more processors during a second time period, the passport as unsigned; and

in response to a determination, by the or more processors, of an unsecured communication channel between the requestor module and the border control agent:

identifying, by the one or more processors, a signing of the unsigned passport by the requestor module;

encrypting, by the one or more processors, the signed passport with a public key of the border control agent; and

transmitting, by the one or more processors, the encrypted passport through the unsecured communication channel.