Firewall for controlling connections between a client machine and a network

US8875272B2 · kind B2 · utility

Assignee

• International Business Machines Corporation · US

Inventors

• Bernhard Jansen · Cologne, DE
• Axel Tanner · Adliswil, CH

Key dates

• Filing date: May 15, 2008
• Grant date: Oct 28, 2014
• Expiry date: Jun 25, 2033

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L63/1441
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

A firewall system adapted for location outside the client machine, preferably in the same data processing device as the client machine but outside a virtual machine containing the client machine. Control logic of the firewall system receives incoming and outgoing connections from the network and client machine respectively. In response to a connection request initiating a connection between respective endpoints in the network and client machine, the control logic performs a security assessment comprising obtaining from at least one of the network and client machine information indicative of the security state of the endpoint therein, and allows or inhibits the connection in dependence on the result of the security assessment. The security assessment may be performed in accordance with a security policy of the system, and different security assessments may be performed for different connection requests in accordance with the security policy.