Firewall permitting access to network based on accessing party identity
The inventive communications management systems manage access to a local area network or network content by external users, applications, and devices. The systems and methods are implemented on a network appliance to manage content within the network and facilitate content transmission through a firewall that separates the network from a larger networking environment, such as the World Wide Web. Other applications operating on the network appliance are made firewall aware so that existing network appliance identity schemes can be used to also control gate access to and from the network, to and from applications that run on the network appliance, and to and from other applications that run on the local network. Because the firewall is integrated closely with other application on the network appliance, after the external user is granted access to the network, network applications can control and terminate access through the firewall as desired.
1. A method, comprising:
at a network appliance comprising a firewall, a policy engine, and a database, monitoring traffic external to a network to identify a request to authenticate from a requestor seeking access to the network;
upon identifying the request to authenticate, performing an identity authentication procedure to validate an identity of the access requestor as one having permission to access the network, the authentication procedure comprising:
comparing the access requestor identity with one or more rules and/or one or more data structures stored on the appliance and/or the network; and
based upon the comparison between the access requestor's identity and the one or more rules and/or the one or more data structures, determining a permissible scope of access to various devices, applications, and databases on the network that the access requestor may be granted; and
granting to the access requestor direct access to a permissible portion of the network within the permissible scope of access.
2. The method as recited in claim 1 , wherein the network appliance further comprises an application and the rules and/or data structures are stored in a database associated with the application.
3. The method as recited in claim 1 , further comprising granting access on a designated port for a limited time period.
4. The method as recited in claim 1 , wherein the request to authenticate is delivered to the network appliance from the access requestor via a web-based service but access from the access requestor to the network does not pass through the web-based service.
5. The method as recited in claim 1 , wherein granting the access requestor direct access to a permissible portion of the network comprises granting access to one or more applications on the network appliance or on other computing devices in the network.
6. The method as recited in claim 1 , wherein the authentication procedure used to determine the scope of the access requestor's granted access is the same method as is used to control access to selected portions of the network by users within the network.