`
`
`
`
`
`
`
`
`
`
`UNIVERSITY OF B.C. LIBRARY
`
`CN3 9424 04802 118 9Firewall
`Architecture
`for the
`Enterprise
`
`
`
`Unified Patents Ex. 1006, pg. 1
`
`Norbert Pohlmann
`Tim Crothers
`
`Unified Patents Ex. 1006, pg. 1
`
`
`
`Firewall
`Architecture for
`the Enterprise
`
`Norbert Pohlmann and Tim Crothers
`
`Wiley Publishing, Inc.
`
`Best-Selling Books e Digital Downloads « e-Books ¢ Answer Networks
`e-Newsletters e Branded Web Sites e e-Learning
`
`Unified Patents Ex. 1006, pg. 2
`
`Unified Patents Ex. 1006, pg. 2
`
`
`
`Firewall Architecture for the Enterprise
`Published by
`Wiley Publishing, Inc.
`909 Third Avenue
`New York, NY 10022
`www.wiley.com
`Copyright © 2002 by Wiley Publishing, Inc., Indianapolis, Indiana
`Library of Congress Control Number: 2002102445
`ISBN: 0-7645-4926-X
`Manufactured in the United States of America
`10987654321
`10/QT/QX/QS/IN
`Published by Wiley Publishing, Inc., Indianapolis, Indiana
`Published simultaneously in Canada
`No part of this publication may be reproduced,stored in a retrieval system or transmitted in any form
`or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as
`permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior
`written permission of the Publisher, or authorization through payment of the appropriate per-copy fee
`to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978)
`750-4744, Requests to the Publisher for permission should be addressed to the Legal Department,
`Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317)
`572-4447, E-Mail: permcoordinator@wiley.com.
`
`
`LIMIT OF LIABILITY/DISCLAIMER OF WARRANTY: WHILE THE PUBLISHER AND AUTHOR HAVE
`
`USED THEIR BEST EFFORTS IN PREPARING THIS BOOK, THEY MAKE NO REPRESENTATIONS OR
`
`WARRANTIES WITH RESPECT TO THE ACCURACY OR COMPLETENESS OF THE CONTENTS OF THIS
`BOOK AND SPECIFICALLY DISCLAIM ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
`FITNESS FOR A PARTICULAR PURPOSE. NO WARRANTY MAY BE CREATED OR EXTENDED BY
`SALES REPRESENTATIVES OR WRITTEN SALES MATERIALS. THE ADVICE AND STRATEGIES
`CONTAINED HEREIN MAY NOT BE SUITABLE FOR YOUR SITUATION. YOU SHOULD CONSULT WITH
`A PROFESSIONAL WHERE APPROPRIATE. NEITHER THE PUBLISHER NOR AUTHOR SHALL BE
`LIABLE FOR ANY LOSS OF PROFIT OR ANY OTHER COMMERCIAL DAMAGES, INCLUDING BUT
`NOT LIMITED TO SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGES.
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`For general information on ourother products and servicesor to obtain technical support, please
`contact our Customer Care Departmentwithin the U.S. at 800-762-2974, outside the U.S. at
`317-572-3993 or fax 317-572-4002.
`
`Wiley also publishes its books in a variety of electronic formats. Some content that appears in print
`may notbe available in electronic books.
`Trademarks: Wiley and the Wiley Publishing logo are trademarksorregistered trademarks of Wiley
`Publishing, Inc., in the United States and other countries, and may not be used without written
`permission. All other trademarks are the property oftheir respective owners. Wiley is not associated
`with any product or vendor mentionedin this book.
`
`@Wiley Publishing, Inc.is a trademark of Wiley Publishing, Inc.
`
`Unified Patents Ex. 1006, pg. 3
`
`Unified Patents Ex. 1006, pg. 3
`
`
`
`Firewall Architecture for the Enterprise
`114
`
`inspection, smart filtering, or
`extended state-oriented packet filters as stateful
`adaptive screening. With this extended functionality, they are often offered as user-
`oriented packet filters. Figure 4-15 illustrates state-oriented packetfilters.
`
` A
`
`Header
`network
`
`Header
`transport
`
`nalysis
`al) v
`
`Analysis Module
`
`
`
`Header
`access
`
`State
`machine
`
`Dat
`aid
`
`
`
`
`
`
`
`Integration Module
`
`
`
`
`Network access layer
`
`
`
`Networkaccess layer
`
`
` Insecure
`
`network
`
`
`
`Network
`
`to be
`protected
`
`
`Figure 4-15: State-oriented packetfilters
`
`State-oriented packet filters have the same advantages aspacketfilters, but they
`can also check the applications. Some risks remain because the services are not
`directly isolated from each other.
`Because it is a complex matter to simultaneously hold and interpret the commu-
`nications data in the different communications layers, state-oriented packetfilters
`generally have a shallower depth of analysis, or they are particularly prone to
`
`Unified Patents Ex. 1006, pg. 4
`
`Unified Patents Ex. 1006, pg. 4
`
`
`
`
`
`Chapter 4: Elements of a Firewall System 115
`
`errors connected with their very powerful software. Basically, you can’t test the
`complex software of state-oriented packetfilters sufficiently or comprehensively to
`prove that errors cannot occur in any operating state. For this reason, one must
`continue to assumethat the complex programscontain potential security risks that
`could be used to perpetrate an attack.
`A better and more secure way to analyze the application data is to use applica-
`tion gateways with proxies. This approach is described in the nextsection.
`
`Network Address Translation
`
`As its name implies, NAT (Network Address Translation) works by using one set of
`addresses for communications on the Internet and a separate set of addresses for
`communications on the internal network. To fully support this translation,
`the
`IANAset aside three ranges of IP addresses in RFC 1918:
`
`@ 10.0.0.0 through 10.255.255.255 (10.0.0.0/8)
`
`@ 172.16.0.0 through 172.31.255.255 (172.16.0.0/12)
`
`@ 192.168.0.0 through 192.168.255.255 (192.168.0.0/16)
`
`These addresses are reserved for internal use only and, as a consequence, are
`nonroutable on the Internet. Attempts to communicate with any of these ranges
`through the Internet result in ICMP “network unreachable”errors.
`An organization implementing NAT uses one of the preceding ranges for their
`internal network addressing. The external interface of the firewall
`is assigned a
`normal routable IP address. When the firewall transmits a packet from the internal
`network to the Internet,
`it actually creates a new packet destined for the same
`address but originating from the external address(es) of the firewall. This packet is
`then transmitted to the destination. The firewall keeps a table of current communi-
`cations so that when the return communications reach thefirewall, they are taken
`and placed into a new packet destined for the internal computer and transmitted
`internally.
`The NATprocess affords a substantial degree of security. Since all direct com-
`munications are prevented (as long as the systems are properly configured), an
`external attacker is forced to compromise the firewall or find a means of passing
`his communications through it successfully rather than attacking the internal host
`directly. Given the firewall protection module and hardening, this is a relatively
`significant challenge.
`Not inconsequentially, NAT prolongsthe life expectancy of IPv4 on the Internet.
`Were it not for address translation, the supply of Internet addresses would have
`been exhausted long ago. Using NAT, a company with hundreds of internal com-
`puters can communicate fully with the Internet using only a handful of routable
`addresses.
`
`Unified Patents Ex. 1006, pg. 5
`
`Unified Patents Ex. 1006, pg. 5
`
`
`
`116
`
`
`Firewall Architecture for the Enterprise
`
`In addition to being used dynamically, NAT is also used in a static translation
`mode. Static translation NAT uses a one-to-one correspondence of an external
`routable address to an internal nonroutable address. It is used for application servers
`such as Web, e-mail, DNS, and FTP where externally originated communications are
`necessary. By using NATin these circumstances, the firewall is still required to be a
`bridge between the internal server and the Internet, thus requiring the attacker to
`deal with the firewall in addition to the host security of the protected server.
`
`Some of the challenges posed by NAT are covered in Chapter 11.
`
`
`
`Application Gateways and Proxies
`
`This section describes how the application gateway firewall element works. The dis-
`tinguishing feature of the application gatewayis that it separates the two networks
`logically and physically, as shown in Figure 4-16.
`In some firewall configurations, the application gateway is the only computer
`system that can be accessed from the insecure network (for example, the Internet);
`thus, the application gateway requires particular protection. For this reason, the
`computer system on which the application gateway is implementedis also referred
`to as a bastion host.
`
`The application gateway —implemented as a dual-homed gateway —has two
`network interfaces, one in the network to be protected and the other in the insecure
`network. The term “dual-homed”refers to the fact that the application gateway has
`complete control over the packets that are to be passed between the insecure net-
`work and the network to be protected.
`The application gateway can also be operated as single-homed —in other words,
`operated with only one network interface. In this case, however, an attacker could
`bypass the application gateway.
`
`ANALOGY TO THE SECURITY GUARD
`The “application gateway security guard” does not just inspect the addresses of
`inbound deliveries. He also opens every packet, examines its contents, and checks
`the shipping documents prepared by the originator against a clearly defined set of
`evaluation criteria. After he has completed his detailed security check, the security
`guard signs the delivery note and sends the truck on its way again. This time, how-
`ever, he arranges for a trustworthy driver from his own companyto take the pack-
`ets to the actual recipient. The security check at this point is significantly more
`reliable than just packet filtering, and the driver of the outside company does not
`see the company premises. It is true that the check takes longer, but as a result, any
`activities that threaten security can be ruled out.
`
`Unified Patents Ex. 1006, pg. 6
`
`Unified Patents Ex. 1006, pg. 6
`
`
`
`
`
`Chapter 4: Elements of a Firewall System 117
`
`Application
`gateway
`
`A
`
`¥
`pecturity management
`
`
` Application
`
`gateway
`
`
` User authentication
`
`
`
`
`
`
`
`[ Zs
`zie ;
`|
`
`
`n service proxy
`
`Telnet proxy
`
`FTP proxy
`
`|
`
`Network driver
`
`|
`
`Network driver
`
`|
`
`Network
`Insecure
`
`
`
`to be
`
`network
`
`
`protected
`
`
`Figure 4-16: Application gateway
`
`How Application Gateways Work
`A user who wants to communicate through the application gateway mustfirst
`identify himself and undergo authentication. Application gateways generally offer
`different authentication procedures.
`To authenticate, the user first establishes a connection with the application gate-
`way. The direct communication partner is not the destination computer system but
`the application gateway. However, onceidentification and authentication are com-
`plete, the application gateway is transparent so that the user has the impression of
`working directly on the destination computer system.
`
`BASIC APPROACH
`The application gateway receives the packets via the network access and TCP/IP dri-
`vers on the appropriate ports. If only one service is to be allowed on a given port,
`software must be available on the application gateway that will transfer the packet
`
`Unified Patents Ex. 1006, pg. 7
`
`Unified Patents Ex. 1006, pg. 7
`
`
`
`118
`Firewall Architecture for the Enterprise
`
`that corresponds to that service from the network on oneside of the application
`gateway to the network on the other side, and vice versa. Such software, which only
`allows packet transmissionsfor oneparticular service (FTP, HTTP, Telnet, and so on)
`through the application gateway,
`is known as a proxy. The term proxy is used
`because, as far as the user accessing thefacilities is concerned, he is communicating
`with the actual serverprocess of the service on the destination computer system.
`Each proxy on the application gateway can offer additional security services tai-
`lored to the service for which it is responsible. Because each proxy specializes in
`one service, the scope of the security and logging functions that are possible on the
`application gateway is greater. A particularly thorough analysis is possible in this
`communication layer, as the context of the application data is clearly defined for
`the relevant service. The proxies concentrate on what is essential. The advantage is
`that small, straightforward modules are used, so that the susceptibility to imple-
`mentation errors is reduced (see Figure 4-17).
`
`Re-encryption or re-coding can be performed in the proxy.
`
`
`
`SECURITY CONCEPT OF AN APPLICATION GATEWAY
`For every service that is to be used over the application gateway, a special proxy
`must be provided. If certain services are to be barred completely, you should have
`no proxies for those services on the application gateway, nor should any other soft-
`ware be present that would enable them to run.
`Thus, aslittle software as possible should be installed on the application gate-
`way to avoid the possibility that, either by mistake or deliberate introduction by an
`attacker, some other software can adopt the role of proxy (packet transmission in
`the application gateway) for a service that ought not to be allowed.
`Security Managementis intended to make work as easy as possible for the user
`and is therefore supplied with powerful software (X-Terminal, database, and so on).
`However, for purposes ofsecurity, it should not be run on the same computersys-
`tem (or at least not at the same time) as the application gateway.
`To prevent the possibility that the proxies will be bypassed, application gateways
`should, for security reasons, have no routing functionality.
`Since the application gatewayis linked during communication to both the com-
`puter system of the insecure network and to the computer system of the protected
`network, the application gateway provides Network AddressTranslation. The appli-
`cation gateway has an IP address in the insecure network (for example, an official
`Internet IP address such as 194.173.3.1) and an IP address in the network to be pro-
`tected (for example, a private IP address such as 192.168.1.60 that is reserved for
`this purpose). During communication with computer systems in the insecure net-
`work, the application gatewayuses the IP addresses of the insecure network; during
`
`Unified Patents Ex. 1006, pg. 8
`
`Unified Patents Ex. 1006, pg. 8
`
`
`
`Chapter 4: Elements of a Firewall System
`
`119
`
`communication with computer systems on the network to be protected, it uses the
`IP addresses of that particular network.
`
`Analysis Modulefor Proxy n
`
`Analysis Module for Proxy Y
`
`Analysisv
`
`State
`machine
`
`
`
`
`
`
`
`Integration Module
`
`Transport
`
`Network (IP-X)
`
`Network access
`
` Insecure
`
`network
`
`
`
`
`to be
`protected
`
`
`
`Figure 4-17: Analysis Modules for proxies on the application gateway
`
`Unified Patents Ex. 1006, pg. 9
`
`
`
`
`
`
`
`
`
`Transport
`
`
`Network(IP-Y)
`
`
`Network access
`
`
` Network
`
`Unified Patents Ex. 1006, pg. 9
`
`
`
`
`
`120 Firewall Architecture for the Enterprise
`
`The Proxies
`
`A distinction can be made between application level proxies and circuit level prox-
`ies in their implementation.
`
`APPLICATION LEVEL PROXIES
`Application level proxies are implemented for particular services and/or applica-
`tions. In other words, they know the commandsof the particular application proto-
`col involved and can analyze and monitor them. Application level proxies work
`with the standard client software for FTP or Telnet (no modifications are necessary)
`or with browsers. However, the procedure followed for user-oriented services may
`differ from the one that
`is usually followed. For example,
`identification and
`authentication with the application level proxy is initially required before transpar-
`ent communication is available to the user.
`In the next section, some application level proxies are described in detail and
`illustrated with particular implementation types, and the basic ideas behind proxy
`technology are presented. Some proxies function according to the store-and-
`forward principle (SMTP), while others are interactive and user-oriented (Telnet,
`FTP, and HTTP).
`
`SMTP PROXY
`An SMTP proxy works according to the store-and-forward principle. Under this
`principle, the SMTP proxy accepts the mail in its entirety, stores it temporarily, and
`then forwardsit. No end-to-end link is required between the actual transmitter and
`the receiver.
`
`ANALOGY WITH A COMPANY’S MAILBOX (MAIL PROXY)
`A mail proxy can be compared to a company’s mailbox. If an employee wants to
`send a letter to another person in the company, he can putit directly or indirectly
`into the company’s mailbox. The letters go to the internal mail room and aredis-
`tributed by a messenger who worksfor the organization. In this way, the external
`mailman does not need to enter the building, and hence presents no risk. The open-
`ing to the outside is a potential area exposed to attack.
`With SMTP proxies, solutions work either with or without a Message Transfer
`Agent (MTA) on the same system. Figure 4-18 shows an SMTP proxy with an MTA
`available.
`
`DESCRIPTION
`The SMTP proxy does not work in a user-oriented fashion, so no user authentica-
`tion is required.
`An SMTP proxy on port 25 receives inbound mail and, after the originator (IP
`address and computer nameof the mail server) has been checked, it is stored on the
`application gatewayin a special directory. The SMTP daemonchecksperiodically to
`see whether any new mail has arrived. The Mail Transfer Agent (MTA) delivers the
`mail to the addressee either directly or through one or more other MTAs. The SMTP
`proxy thus prevents direct access to the internal MTA from the insecure network.
`
`Unified Patents Ex. 1006, pg. 10
`
`Unified Patents Ex. 1006, pg. 10
`
`
`
`
`Chapter 4: Elements of a Firewall System
`121
`
`Outbound
`Inbound
`peeseceemdskeeegtAc ececencoeneuceors
`Port 25
`
`
`MTA
`
`
`
`(sendmail)
`
`
`
`
`
`Figure 4-18: SMTP proxy
`
`One example of a commonly used MTA is Sendmail, which is known to exhibit
`a numberof security weaknesses and implementation errors.
`An SMTP proxy only processes the following commands, which are security-
`neutral:
`
`@ It processes HELO, MAIL, RCPT, DATA, QUIT, RSET, NOOP.
`
`@ Some additional commandsare supported with standard replies in order
`to make communication possible: HELP, VRFY, and EXPN.
`
`Security-relevant commands, such as DEBUG, can send a spontaneous message
`to Security Management. If the DEBUG command is detected in an SMTPproxy, no
`resulting error can occur because the SMTP proxy does notreact to it. However,if
`an outsider attempts to execute a DEBUG command, the fact can be interpreted to
`meanthat it is concealing an attempted attack. This information on an attempted
`attack can be important.
`it is possible to neutralize the complex
`With the store-and-forward principle,
`and error-prone Sendmail program (MTA). In this way, attacks known to exploit the
`shortcomings of Sendmail are prevented,as it is possible to prevent Sendmail from
`being addressed directly and ensure that only the substitute software of the SMTP
`proxies can be accessed. The SMTP proxyis straightforward and thus the software
`is easy to test.
`
`LOGBOOK
`With an SMTPproxy or MTA,the following log data can be recorded in the appli-
`cation gateway’s logbook:
`
`® IP address and nameof the source computer system
`
`@ Time and date of connection setup
`
`Unified Patents Ex. 1006, pg. 11
`
`Unified Patents Ex. 1006, pg. 11
`
`
`
`
`
`122 Firewall Architecture for the Enterprise
`
`® Originator of the mail (as specified in the mail header)
`
`® Addressee of the mail (as specified in the mail header)
`
`@ Numberofbytes transmitted
`@ Time and date of disconnection
`
`If a problem arises, the extensive log data covering events in the SMTP proxy
`can be used to resolveit.
`
`USER-ORIENTED APPLICATION-LEVEL PROXIES
`The proxies for Telnet, FIP, and HTTP are user-oriented proxies that enforce
`authentication of the user concerned, analogousto a security guard. Assuming the
`user is successfully identified and authenticated, this authentication is only good
`for that particular proxy. If the user wants to use anotherservice (that is, a differ-
`ent proxy), he must undergo identification and authentication again. The advan-
`tage of user-oriented proxies is that the user and IP address are, without exception,
`correctly assigned to the desired service.
`
`PROCESS OF COMMUNICATIONS THROUGH
`AN APPLICATION PROXY
`The following example presents a connection setup over the application gateway
`with the aid of a simple password procedure for user-oriented services (refer to
`Figure 4-19).
`
`® Phase 1: Establishing a Connection to the Application Gateway. The
`user attempts to establish a connection from his source computer system
`to a desired destination computer system over the application gateway.
`The application gateway accepts the connection setup and asks the person
`seeking access to undergo identification and authentication.
`@ Phase 2: User Authentication. The user enters his user identification and
`
`the destination computer system (nameor address). A check is performed
`on the application gateway as to whether the user is allowed to access the
`desired destination computer system from his source computer system and
`what restrictions apply to such access. In this case, the user is then asked
`to enter his password. A check is performed on the application gateway as
`to whether the user has entered the correct password(as with the security
`guard).
`
`Authentication in firewall systems can be implemented in a number of
`ways. For example, one can use a standard password procedure, a one-
`time password, or Challenge/Response. Authentication procedures that
`make use of cryptographic algorithms require the user to have a security
`token or smart card. The particular authentication procedure that is used
`generally depends on the protection requirement and the direction of
`communication through the firewall system. Communication through the
`
`Unified Patents Ex. 1006, pg. 12
`
`Unified Patents Ex. 1006, pg. 12
`
`
`
`Chapter 4: Elements of a Firewall System
`
`123
`
`firewall system can be implemented from a network to be protected to an
`insecure network with a simple authentication procedure, or even without
`one. Where communication is directed from an insecure network to a net-
`work to be protected, encryption (involving a security token or smart
`card) should always be used.
`
`Source
`
`Destination
`
`
`gateway
`
`
`
`Establishing
`connection
`
`Please
`
`
`authentication
`enter
`password
`
`Password
`
`
`
`Username,
`destination computer
`
`Establishing
`
`connection
`
`
`
`
`
`
`
`
`
`Disconnect
`
`Figure 4-19: Communication over an application-level proxy
`
`Unified Patents Ex. 1006, pg. 13
`
`Unified Patents Ex. 1006, pg. 13
`
`
`
`
`
`124 Firewall Architecture for the Enterprise
`
`¢@ Phase 3: Establishing a Connection to the Destination Computer. After
`the user seeking access has been successfully identified and authenticated,
`a second connection is established from the application gateway through
`the proxy to the desired and permitted destination computer system.
`
`@ Phase 4: Data Transfer. Data transfer occurs. Depending on the proxy
`concerned, the transfer of data through the proxy is monitored, controlled,
`and logged on the application gateway. This phaseis transparent to the
`user.
`
`@ Phase 5: Disconnection. In the final phase, the connection through the
`application gateway is terminated.
`
`Telnet Proxy
`The Telnet proxy is responsible for controlled communications using Telnet. It pro-
`vides appropriate special security-enforcing functions for this service. A connec-
`tion is established from the source computer system (client) to port 23 of the
`application gateway (the port for the Telnet service).
`The Telnet proxy takes over the connection on port 23. The user on the source
`computer system identifies and authenticates himself, informing the Telnet proxy
`of the connection destination. Once identification and authentication have been
`successfully completed, a user profile containing entries that correspondto the fol-
`lowing information is activated:
`
`@ IP address of the source computer system that wants to establish the
`connection
`
`@ User name that was used during identification and authentication
`
`@ IP address of the destination computer system
`
`The Telnet proxy establishes a second connection from the application gateway
`to port 23 of the destination computer system. The user can now use the Telnetser-
`vice of the destination computer system from the source computer system via the
`Telnet proxy (see Figure 4-20).
`
`CONTROL MONITOR
`During the Telnet session, a control monitor can check whether or not the user is
`accessing the permitted destination computer system from the source computer
`system, or a different computer system without permission. The monitor must
`check the data stream for byte sequences that could possibly be used to hop to a
`different computer. It can also look for other information, such as control charac-
`ters, that are not supposed to be used (for example, Ctrl+C).
`
`Unified Patents Ex. 1006, pg. 14
`
`Unified Patents Ex. 1006, pg. 14
`
`
`
`
`
`Chapter 4: Elements of a Firewall System 125
`
`Workstation
`
`
`
`
`Application gateway
`
`Authentication Ypresettasiseoeceseyateestte:
`
`
`
`
`Userprofile
`
`
`
`
` Port 23
`
`Logbook
`
`Afe,
`
`
`
`
`TELNET proxy
`
`Figure 4-20: Telnet proxy
`
`LOGBOOK
`The Telnet proxy can write the following protocol entries to the logbook of the
`application gateway:
`
`IP address and nameof the source computer system
`
`IP address and name of the destination computer system
`
`¢¢¢¢%@ Time and date of disconnection
`
`Time and date of connection setup
`Name of the user
`
`Number of bytes transmitted
`
`With a Telnet connection, it is often appropriate to make a recording of the com-
`plete communication for audit purposes. This security-enforcing function not only
`permits subsequent analysis of the recording, but also exercises a warning effect
`that should not be underestimated.
`
`EXAMPLE ILLUSTRATING THE USE OF THE AUDIT TRAIL
`The audit security mechanism can be agreed upon in the service contract with a
`company, perhaps in a case where remote maintenanceis being provided. With this
`mechanism in place,
`the employee who performs the maintenance knows that
`everything he does will be recorded and will thus be motivated to perform only
`those actions that are required to complete the job. Should anything untoward
`occur, the log can be used to identify any impermissible or unnecessary actions that
`were carried out via remote access. In other words, the employee's actions can be
`reliably determined after the event.
`
`Unified Patents Ex. 1006, pg. 15
`
`Unified Patents Ex. 1006, pg. 15
`
`
`
`
`
`126 Firewall Architecture for the Enterprise
`
`EXAMPLE OF THE USE OF AN APPLICATION
`GATEWAY WITH TELNET PROXY
`Security can be implemented between two networksthat have different protection
`requirements, using an application gateway with a Telnet proxy. Figure 4-21 shows
`two networks: Network X with the IP address 192.168.3.X, and Network Y with the IP
`address 192.168.5.Y. These two networks are independent of each other; there is no
`direct connection between them. The administrator of Server 1 in Network X is work-
`ing at Workstation A in Network Y and wants to have remote access to Server 1
`in
`Network X. The two networks will be connected using an application gateway with
`Telnet proxy in such a mannerthat only a Telnet session from Workstation A in
`Network Y to Server 1 in Network X is permitted.
`
`Server 2
`
`Server 1
`
`
`
`
`
`192.168.3.4
`192.168.3.3
`Network X
`
`192.168.3.100
`
`Application
`
`192.168.5.200
`
`Network Y
`192.168.5.20
`192.168.5.21
`
`
`gateway
`
`
`
`
`
`
`
`
`
`UserP—Security S e
`
`Workstation B
`Workstation A
`Token
`
`Figure 4-21: Use of an application gateway with Telnet proxy
`
`CHARACTERISTICS OF THE TELNET COMMUNICATION SERVICE
`Telnet communications has the following attributes:
`
`@ Telnet is based on TCP.
`
`The standard port number used by Telnet servers is 23 (TCP destination
`port number).
`
`Unified Patents Ex. 1006, pg. 16
`
`Unified Patents Ex. 1006, pg. 16
`
`
`
`
`Chapter 4: Elements of a Firewall System
`
`127
`
`@ The TCP source port numberused by Telnet clients is any port number
`greater than 1023.
`
`FILTER RULES SPECIFIED FOR USER P
`Here are sometypical rules that might apply to a user.
`
`@ P can only use the Telnet service on server 1 on working days between
`7 a.m. and 6 p.m.
`
`@ P can establish this connection underthe following conditions:
`@ Workstation A must use IP address 192.168.5.20.
`
`= Server 1 must use IP address 192.168.3.3.
`
`@ The transport protocol used is TCP.
`
`@ The Telnet port on server 1 must be 23.
`
`@ The source port on workstation A must be greater than 1023.
`
`@ P must authenticate himself using a security token.
`
`@ The complete connection should be logged.
`
`@ The actions that take place during connection should be monitored (con-
`trol monitor).
`
`@ User P can only use the Telnet service at the specified times, and cannot
`use any otherservices.
`
`@ User P can’t access any other computer systems in network X (for exam-
`ple, server2).
`
`OTHER USERS
`Different users in an organization havedifferent rights to access systems and data.
`Continuing the example rules, users other than P might be subject to the following
`limitations:
`
`@ Cannot access servers | or 2.
`
`Other users cannot obtain any information as to what computer systems
`exist in the other network.
`
`Table 4-4 showsthefilter rules for the Telnet proxy that are necessary to achieve
`the sample rules just outlined.
`
`Unified Patents Ex. 1006, pg. 17
`
`Unified Patents Ex. 1006, pg. 17
`
`
`
`128
`Firewall Architecture for the Enterprise
`
`
`
`TaBLe 4-4 FILTER RULES
`
`
`User Source
`Address
`
`Destination Authenti- Audit Monitor Week- Time
`Address
`cation
`days
`Window
`Procedure
`
`P
`
`192.168.5.20 192.168.3.3
`
`Security
`token
`
`
`Yes
`
`Yes
`
`Mon-Fri 7 a.m. to 6 p.m.
`
`Thesefilter rules specify precisely with which source address workstation A may
`access which destination address of server 1. In addition, precise rules specify the
`time frame within which access is permitted. Finally, the authentication procedure
`and complete logging (audit) and monitoring of actions (control monitor) are also
`specified.
`
`RESULT
`Using an application gateway, you can precisely specify that workstation A can
`have a Telnet session with server 1 at particular times; no other communications
`links through the application gateway are possible.
`The Telnet proxy detects whether any other service has been activated on server1
`on port 23, so that this other service cannot be passed throughthe application gate-
`way with the Telnet proxy. The IP addresses of networks X and Y remain concealed.
`Furthermore, user P can only communicate through the application gateway
`with Telnet after he has been authenticated. Since all actions are logged on the
`application gateway, the actions of user P can be traced from the logbooks. The
`procedureis different for user P than when he is communicating without an appli-
`cation gateway, as he must authenticate himself to the proxy before he is granted
`access to server 1. Once the authentication phase is complete, however, operation of
`the Telnet proxy is transparent.
`
`FTP PROXY
`The FTP proxy is responsible for controlled communications using FTP and pro-
`vides appropriate special security-enforcing functions for this service.
`The connection for the command channelis established from the source com-
`puter system (client) to port 21 (the FTP commandport) of the application gateway.
`The user on the source computer system identifies and authenticates himself,
`informing the FTP service of the connection destination. Once identification and
`authentication have been successfully completed, a user profile containing entries
`that correspond to the following information is activated:
`
`® IP address of the source computer system that wants to establish the
`connection
`
`Unified Patents Ex. 1006, pg. 18
`
`Unified Patents Ex. 1006, pg. 18
`
`
`
`
`
`Chapter 4: Elements of a Firewall System 129
`
`@ User name used during authentication
`
`@ IP address of the destination computer system
`
`The FTP proxy now establishes a second command channel from the application
`gatewayto port 21 of the destination computer system (see Figure 4-22).
`
`
`Application gateway
`
`
` Authentication
`
`
`
`Workstation
`
`User profile
`
`
`
`
`
`
`
`
`
`
`
`
`FTP proxy (Passive support)
`Figure 4-22: FTP proxy
`
`COMMAND FILTER
`The commandfilter analyzes and checksall the FTP commandsentered by the user
`to ensure that they are all entered in the accessrights file (user profile). For exam-
`ple, for the FTP proxy, you can define which commands(cd, put, get, del, and so
`on) can and cannotbe used.
`When the user enters an allowed commandthat entails a