US 6321336

US6321336B1 — System and Method for Redirecting Network Traffic to Provide Secure Communication

Bibliographic data (as supplied): Patent number US6321336B1; application US09/042,293; inventors John Applegate and Jeff Romatoski; original assignee Secure Computing LLC (later assignments to McAfee, Inc. and current assignee listed as McAfee LLC); priority/filing date 1998-03-13; granted 2001-11-20; status "Expired – Lifetime." Classification H04L63/00 and H04L63/02.

Purpose: The invention regulates the flow of inter-network connections through a firewall, protecting private-network resources while permitting communication with unprotected networks such as the Internet. It addresses a difficulty in firewall architectures that must use an indigenous TCP/IP stack without modification (e.g., the Microsoft NT stack), where the local stack must be "tricked," or "spoofed," into accepting IP packets not destined for the firewall.

Plain-language scope: For outbound traffic, the method receives a communication from an internal host having a first destination address; it creates a session control block storing that address, replaces it with a second destination address identifying the firewall's network interface, and routes the communication through the stack. After a security (ACL) check, the session control block is accessed to retrieve the first destination address and the second address is replaced back if the communication is authorized. For inbound traffic, a shim located between the stack and the network interface adapter identifies the appropriate session control block and the internal host's IP address. Because the IP header destination address changes, both the IP header checksum and the TCP header checksum are recalculated. The claimed firewall includes a network interface, network driver, application level proxy, protocol stack, and a shim with means for modifying an address to redirect traffic up the stack to the proxy.

Source: https://patents.google.com/patent/[US6321336](/patent/US6321336)/en

Not established by this excerpt: the full text of the claims; the complete specification, drawings, or omitted passages; the content or status of cited prior art (e.g., application Ser. No. 08/322,078); the correctness of current assignee or legal-status listings; and any litigation, validity, or ownership conclusions.