Intrusion detection

• US 20030105859A1
• Filed: 08/09/2002
• Published: 06/05/2003
• Est. Priority Date: 08/10/2001
• Status: Abandoned Application

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Mayhead, Martin P., King, James E., Garnett, Paul J.
• Application Number:
  US10/215,663
• Publication Number:
  US 20030105859A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 1/183 Internal mounting support structures, e.g. for printed circuit boards, internal connecting means for buses G06F13/409
• CPC Class Codes: G06F 1/187 Mounting of fixed and removable disk drives
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G11B 33/128 of the plurality of recording/reproducing devices, e.g. disk drives, onto a chassis
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H05K 7/1425 of standardised dimensions, e.g. 19"-subrack
• CPC Class Codes: H05K 7/1489 characterized by the mounting of blades therein, e.g. brackets, rails, trays H05K7/1491 takes precedence

Abstract

A server blade may comprise a processor and a network interface. The network interface can be configured be connected to a network remote the server blade. The server blade may be configured to detect an access to the network. The server blade may be further configured as a field replaceable unit. Optionally, the server blade may further comprise an enclosure which encloses the processor.

Claims

1. A server blade comprising at least one processor and a network interface configured to be connected to a network remote to the server blade, the server blade being configured to detect an access to the network, the server blade being further configured as a field replaceable unit.

2. The server blade of claim 1, comprising an enclosure which encloses the at least one processor.

3. The server blade of claim 1, configured to detect an unauthorised access to the network.

4. The server blade of claim 1, configured to detect an undesired access to the network.

5. The server blade of claim 1, configured to detect an intrusion into the network.

6. The server blade of claim 1, configured to detect an attack on the network.

7. The server blade of claim 1, wherein the detection comprises at least one of protocol anomaly detection, traffic rate monitoring, protocol state tracking, IP packet reassembly, evasion sensing, misuse detection, and port scan detection.

8. The server blade of claim 1, configured to perform response processing in response to detection of an access event.

9. The server blade of any claim 8, wherein the response processing comprises storing a record of a detected access event in an event log.

10. The server blade of claim 9, configured to analyse the event log to detect a pattern between detected access events.

11. The server blade of claim 10, configured to determine an attack type based on a detected pattern.

12. The server blade of claim 8, wherein the response processing comprises reporting of a detected access event to a higher level management entity.

13. The server blade of claim 12, comprising a management communication interface operable to transmit a report.

14. The server blade of claim 13, wherein the management communication interface is distinct from the network interface.

15. The server blade of claim 8, wherein the response processing comprises at least one of IP address tracing, quality of service route filtering and session termination.

16. The server blade of claim 1, comprising a solid state memory arranged to store operating software for the server blade.

17. The server blade of claim 1, configured as an intrusion detection blade.

18. The server blade of claim 1, configured as an appliance.

19. A server blade comprising processor means and network interface means for connecting to a network remote to the server blade, the server blade being for detecting an access to the network, the server blade being further configured as a field replaceable unit.

20. A modular computer system comprising:

a carrier operable removably to receive a plurality of computer system modules therein;

a plurality of information processing modules removably received in the carrier, each module having a communications port operable to connect to a communications network internal to the carrier;

a switch operable to connect to the internal communications network to distribute information messages between the modules and to connect to an external communications network; and

an access detection module removably received in the carrier and operable to connect to the internal communications network to detect an access to the internal communications network.

21. The modular computer system of claim 20, comprising a service processor operable to provide a service function for the processing cartridges received in the carrier, and configured to receive a report of a detected access event from the access detection module.

22. A modular computer system comprising:

carrier means for removably receiving a plurality of computer system modules therein;

a plurality of information processing modules removably received in the carrier means, each module having communications means for connecting to a communications network internal to the carrier;

switch means for connecting to the internal communications network for distributing information messages between the modules and for connecting to an external communications network; and

an access detection module removably received in the carrier means for connecting to the internal communications network for detecting an access to the internal communications network.