Service level computer security
DC- US 6,795,918 B1
- Filed: 03/07/2000
- Issued: 09/21/2004
- Est. Priority Date: 03/07/2000
- Status: Expired due to Fees
First Claim
Patent Images
1. A method for filtering a plurality of data packets, the method comprising:
- receiving a data packet from the plurality of the data packets, the received data packet having source, destination, and protocol information;
extracting the source, destination, and protocol information from the received data packet;
providing the extracted information to a non-user configurable decision block, the decision block including information on which services are authorized depending on the extracted information, the non-configurable decision block being substantially free from user adjustment;
dropping the received data packet if the extracted information indicates a request for access to an unauthorized service; and
permitting the received data packet to go through if the extracted information indicates a request for access to an authorized service, wherein the protocol information includes information about transport types.
1 Assignment
Litigations
0 Petitions
Accused Products
Abstract
Novel apparatus and methods for filtering data packets by providing non-user configurable authorization data. The invention provides an efficient, quick, secure, and simple to implement technique for computer communication security, in part, by utilizing service level filtering of data packets.
-
Citations
26 Claims
-
1. A method for filtering a plurality of data packets, the method comprising:
-
receiving a data packet from the plurality of the data packets, the received data packet having source, destination, and protocol information;
extracting the source, destination, and protocol information from the received data packet;
providing the extracted information to a non-user configurable decision block, the decision block including information on which services are authorized depending on the extracted information, the non-configurable decision block being substantially free from user adjustment;
dropping the received data packet if the extracted information indicates a request for access to an unauthorized service; and
permitting the received data packet to go through if the extracted information indicates a request for access to an authorized service, wherein the protocol information includes information about transport types. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A computer security apparatus comprising:
-
a first communication interface coupled to a public network, the first communication interface configured to receive data from the public network, the public network data including a plurality of data packets;
a packet analyzer coupled to the first communication interface, the packet analyzer configured to receive and analyze the data packets from the public network, the packet analyzer including;
a protocol storage device coupled to the first communication interface, the protocol storage device configured to store communication protocol information associated with a first data packet from the plurality of the received data packets;
a source port storage device coupled to the protocol storage device, the source port storage device configured to store source port information associated with the first data packet;
a destination port storage device coupled to the source port storage device, the destination port storage device configured to store destination port information associated with the first data packet, and a lookup table device coupled to the protocol storage, the source port storage, and the destination port storage devices, the lookup table configured to determine based on the data within the first data packet whether the first data packet should be authorized to be transferred through the computer security apparatus; and
a second communication interface coupled to a private network and the packet analyzer, the second communication interface configured to receive the authorized data from the packet analyzer for sending to the private network;
wherein the packet analyzer only permits data packets for a selected group of Internet services to be transferred to the private network and the lookup table device is non-configurable by a computer user, and the communication protocol information includes information about transport types. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18, 19, 20)
-
-
21. A computer security apparatus comprising:
-
a first communication interface coupled to a public network, the first communication interface configured to receive data from the public network, the public network data including a plurality of data packets;
a packet analyzer coupled to the first communication interface, the packet analyzer configured to receive and analyze the data packets from the public network, the packet analyzer including;
a protocol storage device coupled to the first communication interface, the protocol storage device configured to store communication protocol information associated with a first data packet from the plurality of the received data packets;
a source port storage device coupled to the protocol storage device, the source port storage device configured to store source port information associated with the first data packet;
a destination port storage device coupled to the source port storage device, the destination port storage device configured to store destination port information associated with the first data packet, a lookup table device coupled to the protocol storage, the source port storage, and the destination port storage devices, the lookup table configured to determine based on the data within the first data packet whether the first data packet should be authorized to be transferred through the computer security apparatus; and
a second communication interface coupled to a private network and the packet analyzer, the second communication interface configured to receive the authorized data from the packet analyzer for sending to the private network, wherein the packet analyzer only permits data packets for a selected group of Internet services to be transferred to the private network and the lookup table device is non-configurable by a computer user, the second communication interface is configured to receive data from the private network, the private network data including a plurality of data packets;
the packet analyzer is configured to receive and analyze the data packets from the private network;
the first communication interface is configured to receive data from the packet analyzer, and the packet analyzer only permits data packets for a selected group of Internet services to be transferred to the public network. - View Dependent Claims (22, 23, 24)
the protocol storage device is configured to store communication protocol information associated with a second data packet from the plurality of the private network data packets;
the source port storage device is configured to store source port information associated with the second data packet; and
the destination port storage device is configured to store destination port information associated with the second data packet. -
-
23. The apparatus of claim 22 further including a second lookup table device coupled to the protocol, source port, and destination port storages, the second lookup table device configured to determine based on the data within the second data packet whether the second data packet should be authorized to be transferred through the computer security apparatus.
-
24. The apparatus of claim 23 where the two lookup table devices are incorporated together.
-
25. A service level computer security apparatus comprising:
-
means for receiving a data packet from a plurality of data packets, the received data packet having source, destination, and protocol information;
means for extracting the source, destination, and protocol information from the received data packet;
means for providing the extracted information to a non-user configurable decision block, the decision block including information on which services are authorized depending on the extracted information;
means for dropping the received data packet if the extracted information indicates a request for access to an unauthorized service; and
means for permitting the received data packet to go through if the extracted information indicates a request for access to an authorized services, wherein the protocol information includes information about transport types.
-
-
26. A method for converting an unsecured digital transmission line into a secured digital transmission line for transmission of digital data, the digital data being selected from a transmission medium selected from cable modem, xDSL, and other network communications, the method comprising:
-
providing an unsecured network connection, the network connection being coupled to a computer network, the computer network being coupled to a first network and a second network;
inserting into the network connection a computer security apparatus, the computer security apparatus comprising a first communication interface coupled to the first network, the first communication interface configured to receive data from the first network, the first network data including a plurality of data packets;
a packet analyzer coupled to the first communication interface, the packet analyzer configured to receive and analyze the data packets from the first network, the packet analyzer including;
a protocol storage device coupled to the first communication interface, the protocol storage device configured to store communication protocol information associated with a first data packet from the plurality of the received data packets;
a source port storage device coupled to the protocol storage device, the source port storage device configured to store source port information associated with the first data packet;
a destination port storage device coupled to the source port storage device, the destination port storage device configured to store destination port information associated with the first data packet, and a lookup table device coupled to the protocol storage, the source port storage, and the destination port storage devices, the lookup table configured to determine based on the data within the first data packet whether the first data packet should be authorized to be transferred through the computer security apparatus; and
a second communication interface coupled to the second network and the packet analyzer, the second communication interface configured to receive the authorized data from the packet analyzer for sending to the second network;
the packet analyzer only permitting data packets for a selected group of Internet services to be transferred to the private network and the lookup table device is non-configurable by a computer user, which is coupled to the second network.
-
Specification
-
- Resources
Litigation Campaign Assessment
Thank you for your request. You will receive a custom alert email when the Litigation Campaign Assessment is available.
×
Litigation Data
-
Current AssigneeWetro LAN LLC (IP Edge LLC)
-
Original AssigneeSteven T. Trolan
-
InventorsTrolan, Steven T.
-
Primary Examiner(s)Peeso, Thomas R.
-
Application NumberUS09/519,952
-
Time in Patent Office1,659 Days
-
Field of Search713/160, 713/165, 713/167, 713/182, 713/200, 713/201
-
US Class Current713/160
-
CPC Class CodesH04L 63/0236 Filtering by address, proto...
