Firewall device
In a firewall device protecting a specific network against an attack from an external network, a filtering object identifying portion identifies whether or not received data includes filtering object data, a filtering execution/inexecution selector transmits to a source device of the received data, when the received data includes the filtering object data, a selection request of a desire for a filtering execution or inexecution of the received data, does not select the filtering execution of the received data from the source device on a condition that a selection response indicates a desire for the filtering inexecution and the source device is authenticated, but selects the filtering execution under other conditions, and a filtering processor filters the selected received data.
1. A firewall device, comprising:
a transceiver receiving data transmitted from a source device;
a filtering object identifying portion identifying received data including filtering object data;
a filtering processor; and
a filtering execution/inexecution selector
transmitting to the source device of the received data, when the received data includes the filtering object data, a selection request of a filtering execution or filtering inexecution of the received data, and
not executing filtering of the received data from the source device when a response from the source device to the selection request indicates filtering inexecution, and the source device is authenticated,
but otherwise executing filtering of the received data by the filtering processor to filter the filtering object data included in the received data, and
wherein the filtering execution/inexecution selector comprises an authentication result holder, a filtering selection requesting portion, and a filtering selector;
the authentication result holder holds an authentication result of the source device;
the filtering selection requesting portion transmits to the source device of the received data the selection request of the filtering execution or filtering inexecution of the received data; and
the filtering selector does not execute filtering of the received data including the filtering object data from the source device when the response from the source device to the selection request indicates filtering inexecution and the source device is authenticated in the authentication result, but otherwise executes filtering of received data including the filtering object data.
2. The firewall device as claimed in claim 1 , wherein the filtering execution/inexecution selector comprises an authentication result holder, a filtering selection requesting portion, and a filtering selector;
the authentication result holder holds an authentication result of the source device;
the filtering selection requesting portion executes filtering of the received data when the source device is unauthenticated in the authentication result, and transmits the selection request to the source device authenticated in the authentication result; and
the filtering selector does not execute filtering of the received data from the source device authenticated when the response from the source device to the selection request indicates filtering inexecution, but otherwise executes filtering of received data including the filtering object data.
3. The firewall device as claimed in claim 1 , further comprising
an authentication processor;
the filtering selection requesting portion further transmitting an authentication request to the source device, and the authentication processor performing an authentication of the source device based on an authentication response to the authentication request and registering the authentication result in the authentication result holder.
4. The firewall device as claimed in claim 1 , further comprising
a filtering policy holder holding a filtering policy which determines the filtering execution or inexecution of the received data in association with parameters included in the received data;
the filtering object identifying portion providing the received data to the filtering execution/inexecution selector only when the filtering policy indicates filtering execution.
5. The firewall device as claimed in claim 1 , wherein the filtering comprises sanitizing the filtering object data, or discarding the received data.
6. The firewall device as claimed in claim 1 , wherein the filtering object data is preset in the filtering object identifying portion.
7. The firewall device as claimed in claim 3 , wherein the filtering selection requesting portion transmits the authentication request and the selection request concurrently to the source device.
8. The firewall device as claimed in claim 4 , wherein the parameters comprise a destination address, a URL, or a variable value designated by a GET or a POST of the received data to determine the filtering policy based on the parameters.