Intelligent firewall
An intelligent firewall that prevents unauthorized access to a system has been developed. The fire wall does not use a communication address. It receives a data packet and analyzes it to determine its final disposition. Finally, the firewall handles the data packet according to its final disposition.
1. A method of preventing unauthorized access to a system, comprising:
receiving a data packet at a firewall, the data packet comprising an ethernet frame field and a source address, wherein the firewall does not use a communication address;
passively copying the data packet at the firewall, where the passive copying leaves the ethernet frame and the source address unchanged which would otherwise indicate presence of the firewall;
analyzing the passively copied data packet with the firewall to determine the final disposition of the data packet; and
handling the passively copied data packet according to its final disposition, wherein handling the passively copied data packet comprises determining whether to drop the data packet or send the data packet to a final destination, and handling the passively copied data packet further comprises dropping the data packet or sending the data packet to the final destination using the ethernet frame field, the data packet sent without changing the ethernet frame field or the source address.
2. The method of claim 1 , wherein the communication address is a TCP/IP address.
3. The method of claim 1 , wherein the communication address is a MAC address.
4. The method of claim 1 , wherein the communication address is a ethernet address.
5. The method of claim 1 , wherein handling the passively copied data packet comprises sending the data packet to a final destination within the system.
6. The method of claim 1 , wherein handling the passively copied data packet comprises sending the data packet to a final destination outside the system.
7. The method of claim 1 , wherein handling the passively copied data packet comprises dropping the data packet.
8. The method of claim 1 , wherein handling the passively copied data packet comprises denying access to the system.
9. The method of claim 8 , wherein the denying access of a data packet comprises responding to the originator of the data packet with a denial message.
10. The method of claim 8 , further comprising:
dropping the data packet.
11. The method of claim 8 , further comprising:
logging the attempted access to the system of the data packet.
12. The method of claim 11 , wherein the logging is stored on a computer in the system.
13. The method of claim 8 , further comprising:
initiating countermeasures against the originator of the data packet.
14. The method of claim 13 , wherein the countermeasures comprise disguising the operating system used by the system.
15. The method of claim 13 , wherein the countermeasures comprise adjusting window sizes of the system.
16. The method of claim 1 , wherein the firewall does not access a network protocol stack.
17. The method of claim 1 , wherein the firewall accesses a network protocol stack.