Network service zone locking

• US 20040088571A1
• Filed: 03/25/2002
• Published: 05/06/2004
• Est. Priority Date: 01/31/2002
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Lancope, Inc. (Cisco Systems, Inc.)
• Inventors: Jerrim, John, Copeland, John A.
• Granted Patent: US 7,644,151 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A zone locking system detects unauthorized network usage internal to a firewall. The system determines unauthorized network usage by classifying internal hosts inside a firewall into zones. Certain specified zones are unauthorized to initiate client communications with other selected zones. However, zone override services can be designated for each associated internal zone, and thus, authorizing selected network services. An alarm or other appropriate action is taken upon the detection of unauthorized network usage.

Claims

1. A method for determining unauthorized network usage, comprising the steps of:

receiving internal zone data by classification of internal hosts into internal zones;

receiving unauthorized zone data, the unauthorized zone data specifies which designated internal zones are not authorized to communicate with associated unauthorized internal zones;

receiving override service data, the override service data specifies particular network services in which designated internal zones are authorized to participate with the associated unauthorized internal zones;

monitoring network communications;

capturing header information from monitored network communications;

determining which internal hosts are participating in the monitored network communications based on captured header information;

determining the internal zones participating in the monitored zone communications based upon the zone data;

determining unauthorized network usage based upon the unauthorized internal zone data and the override service data; and

generating an alarm upon detection of unauthorized network usage.

2. The method of claim 1, wherein the internal zones are classified by user functions.

3. The method of claim 1, wherein the internal zones are classified by subnet.

4. The method of claim 1, wherein the internal zone data includes an additional zone for outside hosts.

5. The method of claim 1, wherein the particular network services are based upon the client network services utilized by the internal hosts classified in the associated unauthorized internal zone.

6. The method of claim 1, wherein the step of generating an alarm includes providing an address to a filtering table to block the unauthorized network usage.

8. The method of claim 1, wherein the zones are classified by user functions.

9. The method of claim 1, wherein the zones are classified by subnet.

10. The method of claim 1, wherein the step of generating an alarm includes adding a MAC address to a filtering table to block the unauthorized network usage.

17. The method of claim 1, wherein the step of generating an alarm includes providing an address to a filtering table to block the unauthorized network usage.

7. A method for determining unauthorized network usage, comprising the steps of:

receiving zone data by classification of hosts into zones;

receiving unauthorized zone data, the unauthorized zone data specifies which designated zones are not authorized to communicate with associated unauthorized zones;

receiving override service data, the override service data specifies particular network services in which designated zones are authorized to participate in communications with the associated unauthorized zones acting as a client;

monitoring network communications;

capturing header information from monitored network communications;

determining which hosts are participating in the monitored network communications based on captured header information;

determining a client host for each monitored network communication;

determining the zones participating in the monitored zone communications based upon the zone data;

determining unauthorized network usage based upon the unauthorized zone data and the override service data; and

generating an alarm upon detection of unauthorized network usage.

11. A system for determining unauthorized network usage, comprising:

a computer system operable to receive internal zone data by classification of internal hosts into internal zones;

the computer system operable to receive unauthorized zone data, the unauthorized zone data specifies which associated unauthorized zones are not authorized to initiate client communications to designated internal zones;

the computer system operable to receive override service data, the override service data specifies particular network services in which designated internal zones are authorized to receive from the associated unauthorized zones;

the computer system operable to capture header information from monitored network communications;

the computer system operable to determine which internal hosts are participating in the monitored network communications based on captured header information;

the computer system operable to determine the internal zones participating in the monitored zone communications based upon the internal zone data;

the computer system operable to determine unauthorized network usage based upon the unauthorized zone data and the override service data; and

a communication mechanism coupled to the computer system operable to provide an alarm upon detection of unauthorized network usage.

13. The system of claim 12, wherein the internal zones are classified by user functions.

14. The system of claim 12, wherein the internal zones are classified by subnet.

15. The system of claim 12, wherein the internal zone data includes an additional zone for outside hosts.

16. The system of claim 12, wherein the particular network services are based upon the client network services utilized by the internal hosts classified in the associated unauthorized zone.

18. A system for determining unauthorized network usage, comprising:

a computer system operable to zone data by classification of hosts into zones;

the computer system operable to receive unauthorized zone data, the unauthorized zone data specifies which designated zones are not authorized to communicate with associated unauthorized zones;

the computer system operable to receive override service data, the override service data specifies particular network services in which designated zones are authorized to participate in communications with the associated unauthorized zones acting as a client;

the computer system operable to monitor network communications;

the computer system operable to capture header information from monitored network communications;

the computer system operable to determine which hosts are participating in the monitored network communications based on captured header information;

the computer system operable to determine a client host for each monitored network communication;

the computer system operable to determine the zones participating in the monitored zone communications based upon the zone data;

the computer system operable to determine unauthorized network usage based upon the unauthorized zone data and the override service data; and

a communication mechanism coupled to the computer system operable to provide an alarm upon detection of unauthorized network usage.

19. The system of claim 18, wherein in the internal zone zones are classified by user functions.

20. The system of claim 18, wherein in the internal zone zones are classified by subnets.