System and apparatus for providing network security
First Claim
Patent Images
1. A system comprising:
- rule engine hardware configured to receive data flows between a network and an application, said rule engine being provided between said network and said application, said rule engine being configured to;
parse frames of the received data flows,determine a match of one or more frames of one of the received data flows to data flow information stored by the rule engine, andin response to the determined match, perform an action with respect to said one of the received data flows, said rule engine being associated with at least one first key; and
controller hardware configured to provide control information to said rule engine to define one or more actions which are to be performed with respect to one or more of said received data flows, said controller being associated with at least one second key;
a first data store comprising said at least one first key; and
a second data store comprising said at least one second key,wherein said at least one first key and said at least one second key are used to encrypt at least one communication between said rule engine and said controller resulting in at least one communication between said rule engine and said controller being secure.
2 Assignments
0 Petitions
Accused Products
Abstract
A rule engine receives data flows. The data flows are between a network and an application. The rule engine determines data flow information and in dependence on the information performs an action with respect to said flow. A controller provides control information to the rule engine to define one or more actions. The communications between said rule engine and said controller are secure.
-
Citations
30 Claims
-
1. A system comprising:
-
rule engine hardware configured to receive data flows between a network and an application, said rule engine being provided between said network and said application, said rule engine being configured to; parse frames of the received data flows, determine a match of one or more frames of one of the received data flows to data flow information stored by the rule engine, and in response to the determined match, perform an action with respect to said one of the received data flows, said rule engine being associated with at least one first key; and controller hardware configured to provide control information to said rule engine to define one or more actions which are to be performed with respect to one or more of said received data flows, said controller being associated with at least one second key; a first data store comprising said at least one first key; and a second data store comprising said at least one second key, wherein said at least one first key and said at least one second key are used to encrypt at least one communication between said rule engine and said controller resulting in at least one communication between said rule engine and said controller being secure. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. A system comprising:
-
rule engine hardware configured to receive data flows between a network and an application, said rule engine being provided between said network and said application, said rule engine having a first data store comprising at least one first key, said rule engine being configured to; parse frames of the received data flows, determine a match of one or more frames of one of the received data flows to data flow information stored by the rule engine, and in response to the determined match, perform an action with respect to said one of the received data flows, said rule engine configured to receive control information from a controller defining one or more of said actions which are to be performed with respect to one or more of said received data flows, wherein said at least one first key is used to encrypt at least one communication between said rule engine and said controller resulting in said at least one communication between said rule engine and said controller being secure, wherein the system is a network interface device. - View Dependent Claims (21)
-
-
22. A system comprising:
-
controller hardware, said controller configured to provide control information to a rule engine in a network interface device to define one or more actions, the rule engine configured to receive data flows between a network and an application and to perform one or more of said actions with respect to one of the received data flows in response to determining a match of one or more frames of the one of the received data flows to data flow information stored by the rule engine, said controller having a second data store comprising at least one second key, wherein said at least one second key is used to encrypt at least one communication between said rule engine and said controller resulting in said at least one communication between said rule engine and said controller being secure, wherein the system is a server apparatus. - View Dependent Claims (23)
-
-
24. A computer program product, the computer program product being embodied on a non-transient computer-readable medium and including software code portions which when executed on a processor provide a rule engine which:
-
receives data flows, said data flows being between a network and an application; parses frames of the received data flows; determines a match of one or more frames of one of the received data flows to data flow information stored by the rule engine; in response to the determined match, performs an action with respect to said one of the received data flows; and receives control information from a controller defining one or more of said actions to be performed with respect to one or more of said received data flows, said rule engine having a first data store comprising at least one first key, wherein said at least one first key is used to encrypt at least one communication between said rule engine and said controller resulting in said at least one communication between said rule engine and said controller being secure.
-
-
25. A computer program product, the computer program product being embodied on a non-transient computer-readable medium and configured so as when executed on a processor to provide a controller which:
-
provides control information to a rule engine in a network interface device to define one or more actions, the rule engine configured to receive data flows between a network and an application and to perform one or more of said actions with respect to one of the received data flows in response to determining a match of one or more frames of the one of the received data flows to data flow information stored by the rule engine, said controller having a second data store comprising at least one second key, wherein said at least one second key is used to encrypt at least one communication between said rule engine and said controller resulting in said at least one communication between said rule engine and said controller being secure.
-
-
26. A system comprising:
-
rule engine hardware configured to; receive data flows, said data flows being between a network and an application; parse frames of the received data flows; and determine a match of one or more frames of one of the received data flows to data flow information stored by the rule engine, said rule engine being provided between said network and said application, said rule engine being configured to, in response to the determined match perform an action with respect to said one of the received data flows, receive control information from a controller defining one or more of said actions which are to be performed with respect to one or more of said received data flows, said rule engine having a first data store comprising at least one first key, wherein said at least one first key is used to encrypt at least one communication between said rule engine and said controller resulting in said at least one communication between said rule engine and said controller being secure, wherein the system is a firewall device. - View Dependent Claims (27)
-
-
28. A system comprising:
-
rule engine hardware configured to; receive data flows, said data flows being between a network and an application; parse frames of the received data flows; determine a match of one or more frames of one of the received data flows to data flow information stored by the rule engine, said rule engine being provided between said network and said application, said rule engine being configured to, in response to the determined match, perform an action with respect to said one of the received data flows, said rule engine configured to receive control information from a controller defining one or more of said actions which are to be performed with respect to one or more of said received data flows, said rule engine having a first data store comprising said at least one first key, wherein said at least one first key is used to encrypt at least one communication between said rule engine and said controller resulting in said at least one communication between said rule engine and said controller being secure, wherein the system is a switch. - View Dependent Claims (29)
-
-
30. A system comprising:
-
a hardware device configured to provide a hypervisor comprising a rule engine configured to; receive data flows, said data flows being between a network and an application; parse frames of the received data flows; and determine a match of one or more frames of one of the received data flows to data flow information stored by the rule engine, said rule engine being provided between said network and said application, said rule engine being configured to in response to the determined match, perform an action with respect to said one of the received data flows, said rule engine configured to receive control information from a controller defining one or more of said actions which are to be performed with respect to one or more of said received data flows, said rule engine having a first data store comprising said at least one first key, wherein said at least one first key is used to encrypt at least one communication between said rule engine and said controller resulting in said at least one communication between said rule engine and said controller being secure, wherein the system is a data processing device.
-
Specification