Mcafee, Inc.

Mark J McArdle

Brent A Johnston

Philip D R Nathan

James Dool

A method, system, and policy file data structure stored on computer-readable medium comprise reading a policy identifier field containing data representing an identifier for a security policy. Further, a protocol identifier field is read containing data representing an identifier for a protocol associated with the security policy identified in the policy identifier field. In addition, a protocol element entry containing data representing a protocol element for protocol identified by the protocol identifier field is associated with a network adapter.

Automatically configuring a computer firewall based on network connection

Intrusion prevention for a computer is based on intrusion rules corresponding to active networked applications executing on the computer. The intrusion rules are a subset of a full ruleset that may include signatures of known attacks or heuristic rules. The subset changes as network connections for active applications are initiated and terminated, or as the active applications terminate.

Intrusion prevention for active networked applications

A firewall protecting a computer is automatically configured to a particular security policy based on an address assigned to a network adapter. A zone that contains the network address is determined and a security policy that is assigned to the zone is associated with the network adapter. The security policy specifies the configuration the firewall uses when handling network traffic between the adapter and the network corresponding to the address. In another aspect, the address assigned to the network adapter is also determined.

Outgoing data units, such as packets, from a computer system that contain data characteristic of an operating system executing on the computer system are intercepted before they are transmitted on a network and masked to impersonate a different operating system if the network is untrusted. The masking may be to re-fingerprint the data units by replacing the data characteristic of the actual operating system with data characteristic of the different operating system. Alternatively, the masking may require discarding the data unit and not transmitting it.

Prevention of operating system identification through fingerprinting techniques

An application policy engine for a computer blocks access to network resources by applications executing on the computer that are not authorized for such access by an application policy file. The application policy engine monitors outgoing network traffic from the computer and compares an identifier for the application contained in a network access request with application identifiers stored in the application policy file. If the application identifier is associated with an unauthorized application, access to the network is blocked by the application policy engine. In another aspect, an unauthorized application is allowed access to certain resources on a network while being blocked from other resources on the same network. In still a further aspect, an authorized application may be permitted only certain types of access to a network or network resource.

Growing community of inventors

Conestogo, Canada

Mark J McArdle