Cross Network Layer Correlation Firewalls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls, particularly network layer firewalls, face challenges in allowing protocols like UDP and RTP to pass through, limiting the deployment of VoIP and multimedia applications due to the need for packet inspection and the inefficiency of existing methods to open communication channels without compromising security.
Innovation Solution
The system correlates protocol communications with established sessions or service needs, allowing packets to pass through by matching session or service information stored in a firewall-accessible location, enabling secure passage of VoIP and RTP streams without weakening firewall policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the firewall inspects each packet to maintain security, then security policy compliance is improved, but the ability of UDP and RTP protocols to pass through deteriorates
Solution Approach 1:
The firewall performs preliminary actions by establishing session information in advance for authorized communication flows. When a session is authorized, the firewall pre-configures the session details (source/destination IPs, ports, protocols) into an accessible data structure before actual packet filtering begins. This allows subsequent packets to be matched against pre-established session criteria rather than requiring full inspection of each packet, enabling UDP and RTP protocols to pass through efficiently while maintaining security compliance.
2Adaptability or versatility
If the firewall opens a hole in the firewall to allow UDP packets through, then protocol passage is improved, but packet inspection capability deteriorates
Solution Approach 1:
The firewall applies local quality by creating targeted session-specific exceptions rather than opening general holes. Each authorized session receives localized access permissions defined by specific criteria (source IP, destination IP, port ranges, protocol types) stored in session information. This allows UDP packets to pass through for authorized sessions while maintaining full inspection capability for all other traffic. The session information acts as a localized access rule set that applies only to specific communication flows, preserving overall firewall security while enabling necessary protocol passage.
3Reliability
If the firewall inspects every packet for security, then security verification is improved, but processing efficiency deteriorates
Solution Approach 1:
The firewall performs preliminary action by pre-establishing session information that defines authorized communication patterns before packet filtering begins. Session information includes pre-configured criteria such as source and destination addresses, port ranges, and allowed protocols. When packets arrive, the firewall performs efficient matching against these pre-defined session criteria rather than conducting full inspection of each packet. This preliminary configuration enables rapid packet processing while maintaining security verification, as the session information represents pre-authorized security policies that eliminate the need for repetitive full-packet analysis.
4Adaptability or versatility
If the firewall uses heuristic inspection for secure packets, then protocol flexibility is improved, but inspection accuracy deteriorates
Solution Approach 1:
The firewall performs preliminary action by establishing precise session information that defines exact matching criteria for authorized packets. Session information includes specific source and destination addresses, port ranges, and protocol identifiers that provide accurate matching rules. This preliminary configuration enables the firewall to apply precise, rule-based filtering rather than relying on heuristic methods. The session information acts as a pre-defined accuracy standard that maintains high inspection precision while supporting multiple protocols, as each session has explicitly defined criteria that eliminate ambiguity in packet evaluation.
Data Source
AI summary
Lower layer traffic such as RTP streams or UDP packets that typically are not allowed through a firewall are permitted through the firewall by correlating the traffic with higher level communications already established, or messages exchanged, at a higher level layer such as for SIP sessions. Communication information and policies can be made available to the firewall, such that the firewall can allow through any packets for an active communication between authorized addresses through an authorized port. Such an approach can allow data such as streamed data and VoIP data to be passed through a firewall without weakening firewall policies.