Reverse firewall with self-provisioning
An application provisioning device may be used to manage a profile of a host and provide data corresponding to a selected application for installation at a host. A reverse firewall may use the profile of the host to determine whether to allow or block particular network communication from an application running on the host. An indication of a selected application may be received at the application provisioning device. Configuration information may also be received at the application provisioning device. The application provisioning server may request an update to the profile of a host and transmit such a request. The profile may be updated to reflect the configuration information and/or information of the selected application. Data corresponding to the selected application may be updated and transmitted to a host computer, where it may be installed. Therefore, the installed application running on the host may operate without being prematurely blocked by the reverse firewall.
1. An apparatus comprising:
a memory having an application program stored in the memory;
a computer coupled to the memory, the application program when executed on the computer causing the computer to perform operations comprising:
receive an indication of a selected application of a computing device;
to transmit a request to update a profile of a host to reflect configuration information related to the selected application;
to modify the profile for use with a reverse firewall device;
to determine a rate of communications from the host attributable to the selected application that are unauthorized based on the profile, the rate of communications being computed as a ratio of a number of message units per unit of time; and
to use the reverse firewall device to determine whether to block a particular communication from the host based on the rate of communications from the host that are unauthorized based on the profile.
2. A method, comprising:
receiving an indication of a selected application of a computing device;
transmitting a request to update a profile of a host to reflect configuration information related to the selected application;
configuring the profile for use with a reverse firewall device;
determining a rate of communications from the host attributable to the selected application that are unauthorized based on the profile, the rate of communications being computed as a ratio of a number of message units per unit of time; and
using the reverse firewall device to determine whether to block a particular communication from the host based on the rate of communications from the host that are unauthorized based on the profile.
3. The method of claim 2 further comprising configuring the reverse firewall device to use a throttling discipline and out-of-profile counter to determine whether to block the particular communication from the host.
4. The method of claim 2 , further comprising presenting at least one application, the at least one application comprising the selected application.
5. The method of claim 2 including transmitting a request to update the profile while the profile is empty of configuration information before transmitting a request to update the profile of the host.
6. The method of claim 2 including, the configuration information comprising information indicating an internal host that the selected application is configured to access.
7. The method of claim 2 , further comprising:
updating data that corresponds to the selected application to reflect the configuration information, wherein the configuration information is predetermined configuration information; and
transmitting the data that corresponds to the selected application.
8. The method of claim 2 , further comprising:
receiving the configuration information;
updating data that corresponds to the selected application to reflect the configuration information; and
transmitting the data that corresponds to the selected application.
9. An apparatus, comprising:
a processor that executes instructions;
a memory coupled to the processor and configured to store data corresponding to a selected application that comprises the instructions, the instructions when executed by the processor causing the processor to perform operations comprising:
presenting at least one application choice for download to a host, receive an indication of the selected application for download to the host,
transmitting data that corresponds to the selected application, and
transmitting a request to update a profile of the host to reflect configuration information of the selected application, the updated profile indicating whether to block a particular communication from the host; and
a reverse firewall device to determine a rate of communications from the host attributable to the selected application that are unauthorized based on the profile, the rate of communications being computed as a ratio of a number of message units per unit of time, and to determine whether to block the particular communication from the host based on the rate of communications from the host that are unauthorized based on the profile.
10. The apparatus of claim 9 , wherein the reverse firewall device is further to apply a throttling discipline to communication from the host based on the profile, the apparatus further comprising:
an out-of-profile counter to generate a count of out-of-profile communications from the host, the reverse firewall device being further to determine whether to block the particular communication from the host based on the count of out-of-profile communications from the host.
11. The apparatus of claim 9 , the configuration information being predetermined configuration information.
12. The apparatus of claim 9 , wherein the operations further comprise:
receive the configuration information, and update the data that corresponds to the selected application to reflect the received configuration information.
13. A non-transitory computer-readable medium comprising instructions which, when executed by a computing device, cause the computing device to perform operations comprising:
receiving an indication of a selected application for downloading to a host;
transmitting data that corresponds to the selected application to the host; configure the profile for use with a reverse firewall device;
determining a rate of communications from the host attributable to the selected application that are unauthorized based on the profile, the rate of communications being computed as a ratio of a number of message units per unit of time; and
using the reverse firewall device to determine whether to block a particular communication from the host based on the rate of communications from the host that are unauthorized based on the profile.
14. The non-transitory computer-readable medium of claim 13 , wherein the configuration information is predetermined configuration information.
15. The non-transitory computer-readable medium of claim 13 , wherein the operations further comprise:
receiving the configuration information and update data that corresponds to the selected application to reflect the received configuration information.
16. The non-transitory computer-readable medium of claim 13 , wherein the profile comprises a 4-tuple rule defined by protocol, client, server port, and server profile.
17. The non-transitory computer-readable medium of claim 13 , wherein the profile comprises a 3-tuple rule defined by protocol, client, and server profile.
18. The non-transitory computer-readable medium of claim 13 , wherein the profile comprises a 2-tuple rule defined by protocol and server profile.
19. The non-transitory computer-readable medium of claim 13 , wherein the profile comprises a 3-tuple rule defined by protocol, server port, and server profile.