Systems and methods for distributed network protection

• US 20020023227A1
• Filed: 08/10/2001
• Published: 02/21/2002
• Est. Priority Date: 08/18/2000
• Status: Active Grant

• Current Assignee: Invicta Networks, Inc.
• Original Assignee: Invicta Networks, Inc.
• Inventors: Sheymov, Victor I., Turner, Roger B.
• Granted Patent: US 7,406,713 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Through the use of an intermediate party, a first party is given the ability to communicate with a second party, with the communication appearing as if it originated with the intermediate party. Specifically, in a protected network system, the protected network is capable of acting as a conduit through which an entity, such as law enforcement, can communicate with an entity attempting an unauthorized access attempt unbeknownst to the entity attempting the unauthorized access attempt. This allows, for example, the detection and identification of the entity attempting the unauthorized access attempt.

Claims

1. A network protection system comprising:

a communications management system; and

an analysis system, wherein the analysis system receives information associated with an unauthorized access attempt and at least one of forwards a portion of the received information to at least one destination and forwards instructions to an intrusion detection system.

2. The system of claim 1, wherein the information associated with an unauthorized access attempt is received from an intrusion detection system.

3. The system of claim 2, wherein the intrusion detection system at least detects one or more unauthorized access attempts.

4. The system of claim 1, wherein the analysis system verifies the legitimacy of one or more access attempts.

5. The system of claim 1, wherein the analysis system communicates information regarding an unauthorized access attempt to a monitoring center.

6. The system of claim 1, wherein the analysis system communicates with the at least one destination via a communications link.

7. The system of claim 6, wherein the communications link is a secure tunnel.

8. The system of claim 1, wherein the analysis system enables communication between the at least one destination and one or more entities attempting the unauthorized access attempt.

9. The system of claim 1, wherein the one or more entities attempting the unauthorized access attempt is unaware that they are communicating with the at least one destination.

10. The system of claim 1, wherein communications from the at least one destination are modified to appear as if they have a predetermined origin.

11. A method of protecting a network comprising:

managing one or more network communications; and

receiving information associated with an unauthorized access attempt and at least one of forwarding a portion of the received information to at least one destination and forwarding instructions to an intrusion detection system.

12. The method of claim 11, further comprising receiving unauthorized access attempt information from an intrusion detection system.

13. The method of claim 12, further comprising detecting one or more unauthorized access attempts.

14. The method of claim 11, further comprising verifying the legitimacy of one or more access attempts.

15. The method of claim 11, further comprising communicating information regarding an unauthorized access attempt to a monitoring center.

16. The method of claim 11, further comprising communicating with the at least one destination via a communications link.

17. The method of claim 16, wherein the communications link is a secure tunnel.

18. The method of claim 11, further comprising establishing communication between the at least one destination and one or more entities attempting the unauthorized access attempt.

19. The method of claim 11, wherein the one or more entities attempting the unauthorized access attempt is unaware that they are communicating with the at least one destination.

20. The method of claim 11, wherein communications from the at least one destination are modified to appear as if they have a predetermined origin.

22. The media of claim 11, further comprising information that receives unauthorized access attempt information from an intrusion detection system.

23. The media of claim 12, further comprising information that detects one or more unauthorized access attempts.

24. The media of claim 11, further comprising information that verifies the legitimacy of one or more access attempts.

25. The media of claim 11, further comprising information that communicates information regarding an unauthorized access attempt to a monitoring center.

26. The media of claim 11, further comprising information that communicates with the at least one destination via a communications link.

27. The media of claim 16, wherein the communications link is a secure tunnel.

28. The media of claim 11, further comprising information that establishes communication between the at least one destination and one or more entities attempting the unauthorized access attempt.

29. The media of claim 11, wherein the one or more entities attempting the unauthorized access attempt is unaware that they are communicating with the at least one destination.

30. The media of claim 11, wherein communications from the at least one destination are modified to appear as if they have a predetermined origin.

21. An information storage media comprising information that protects a network comprising:

information that manages one or more network communications; and

information that receives information associated with an unauthorized access attempt and at least one of forwarding a portion of the received information to at least one destination and forwarding instructions to an intrusion detection system.