Real time active network compartmentalization

• US 20020059528A1
• Filed: 10/11/2001
• Published: 05/16/2002
• Est. Priority Date: 11/15/2000
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Dapp, Michael C.
• Granted Patent: US 7,213,265 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 11/1482 by means of middleware or OS functionality
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Security policy manager devices are leveraged by manager objects to use highly secure user transparent communications to provide detection of questionable activities at every node, automatic collection of information related to any potential attack, isolation of the offending object with arbitrary flexibility of response (e.g. flexibly determining the level of certainty of an attack for initiation of a response in accordance with the number of nodes to be partitioned that is determined by the collected data concerning the potential attack), changing trust relationships between security domains, limiting the attack and launching offensive information warfare capabilities (e.g. outbound from the compromised node while limiting or eliminating inbound communications) in log time and simultaneously and/or concurrently in different but possibly overlapping sections or segments of a digital network of arbitrary configuration.

Claims

1. A method of operating a digital communication network having a plurality of nodes which have a locally hierarchical relationship, comprising the steps of:

detecting a condition at a first node and communicating the condition to a trusted second node locally higher in said hierarchical relationship;

collecting information regarding said condition through nodes at the same or higher hierarchical level as said trusted second node; and

controlling a response at said first node in response to said information.

2. A method as recited in claim 1, wherein said communicating is performed over said digital communication network separately from user data communications.

3. A method as recited in claim 1, wherein said communicating and said controlling step are performed by user transparent communications over said digital network.

4. A method as recited in claim 1, wherein said communicating and said controlling step are performed at bit rates of at least 10 Gbps.

5. A method as recited in claim 2, wherein said communicating and said controlling step are performed preferentially to said user data communications.

6. A method as recited in claim 1, wherein said controlling step establishes a virtual private network.

7. A method as recited in claim 1, wherein said controlling step implements at least one of a mandatory access control policy and a discretionary access control policy.

8. A method as recited in claim 1, wherein said communicating establishes a trust level for a node of said digital network.

9. A method as recited in claim 1, wherein said communicating establishes a secure session between contiguous nodes of said digital network.

10. A method as recited in claim 1, including the further step of detecting a foreign security policy manager connection.