System and method for internal network data traffic control

• US 20040146006A1
• Filed: 01/24/2003
• Published: 07/29/2004
• Est. Priority Date: 01/24/2003
• Status: Abandoned Application

• Current Assignee: DeepNines Incorporated
• Original Assignee: DeepNines Incorporated
• Inventors: Jackson, Daniel H.
• Application Number:
  US10/351,469
• Publication Number:
  US 20040146006A1
• Time in Patent Office: Days
• US Class Current: 370/230
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/266 Stopping or restarting the source, e.g. X-on or X-off
• CPC Class Codes: H04L 47/29 using a combination of thresholds
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Disclosed are systems and methods which implement network data traffic identification and analysis at a low level in the network to thereby filter and/or prevent undesired data communication sourced therein. Preferred embodiments utilize a network interface of the present invention, having intelligent control logic thereon, to provide tagging of data packets for identification and/or analysis, such as to provide filtering of further transmission of appropriate data packets by a server deployed at the edge of an external network. Additionally or alternatively, a network interface of the present invention may be utilized to prevent communication of data packets, such as by recognizing that a transmission bandwidth threshold is being exceeded and, therefore, disabling transmission of data packets.

Claims

1. A system for controlling network data traffic, said system comprising:

a network interface having control logic thereon for monitoring communication bandwidth utilization associated with said network interface and for decreasing communication of data associated with said network interface as a function of said monitored communication bandwidth utilization.

2. The system of claim 1, wherein said control logic comprises at least one data communication bandwidth threshold value.

3. The system of claim 2, wherein said at least one data communication bandwidth threshold value is associated with a particular port of said network interface.

4. The system of claim 2, wherein said at least one data communication bandwidth threshold value is established as a function of a network service provided by a host system of said network interface.

5. The system of claim 2, wherein said at least one data communication bandwidth threshold value is established empirically as a function of normal operation of a host system of said network interface.

6. The system of claim 2, wherein said control logic issues an alarm message to a separate management console when said monitored communication bandwidth utilization exceeds said at least one data communication bandwidth threshold value.

7. The system of claim 6, wherein said alarm message is communicated to said management console via a communication channel separate from that of said monitored communication bandwidth utilization.

8. The system of claim 7, wherein said communication channel comprises an Internet security protocol channel.

9. The system of claim 6, wherein said control logic decreasing said communication of data associated with said network interface is under control of a control signal provided by said management console responsive to said alarm message.

10. The system of claim 9, wherein said control signal is communicated to said network interface via a communication channel separate from that of said monitored communication bandwidth utilization.

11. The system of claim 10, wherein said communication channel comprises an Internet security protocol channel.

12. The system of claim 2, wherein said control logic decreasing said communication of data associated with said network interface is under autonomous control of said control logic.

13. The system of claim 1, wherein said control logic comprises a hierarchy of data communication bandwidth threshold values.

14. The system of claim 13, wherein said control logic issues an alarm message to a separate management console when said monitored communication bandwidth utilization exceeds said a first data communication bandwidth threshold value of said hierarchy of data communication bandwidth threshold values, and wherein said control logic autonomously decreases said communication of data associated with said network interface when said monitored communication bandwidth utilization exceeds a second data communication bandwidth threshold value of said hierarchy of data communication bandwidth threshold values.

15. The system of claim 1, wherein said control logic decreasing said communication of data associated with said network interface comprises disabling an input/output function of said network interface.

16. The system of claim 1, wherein said control logic decreasing said communication of data associated with said network interface comprises disabling a particular port of said network interface.

17. The system of claim 1, wherein said network interface further has control logic thereon for tagging data communicated thereby with a preselected classification.

18. The system of claim 17, wherein all data transmitted by a host system associated with said network interface is tagged with the same said preselected classification.

19. The system of claim 17, wherein said preselected classification indicates a level of trust associated with a host system of said network interface.

20. The system of claim 17, wherein said preselected classification indicates a level of protection to be afforded said data.

21. The system of claim 17, wherein said preselected classification is associated with a particular port of said network interface.

22. The system of claim 17, wherein said tagging said data comprises inserting a classification flag into a header block of a data packet associated with said data.

23. The system of claim 17, further comprising:

a data filter operable to analyze said data for said classification and to allow or prevent further transmission of said data based upon said classification.

24. The system of claim 23, wherein said data filter is disposed at a network edge.

25. The system of claim 23, wherein said data filter utilizes trust information in determining whether to allow or prevent said further transmission of said data based upon said classification.

26. A system for controlling network data traffic, said system comprising:

a network interface having control logic thereon for tagging data communicated thereby with a preselected classification; and

a data filter operable to analyze said data for said classification and to allow or prevent further transmission of said data based upon said classification.

27. The system of claim 26, wherein all data transmitted by a host system associated with said network interface is tagged with the same said preselected classification.

28. The system of claim 26, wherein said preselected classification indicates a level of trust associated with a host system of said network interface.

29. The system of claim 26, wherein said preselected classification indicates a level of protection to be afforded said data.

30. The system of claim 26, wherein said preselected classification is associated with a particular port of said network interface.

31. The system of claim 26, wherein said tagging said data comprises inserting a classification flag into a header block of a data packet associated with said data.

32. The system of claim 26, wherein said data filter is disposed at a network edge.

33. The system of claim 26, wherein said data filter utilizes trust information in determining whether to allow or prevent said further transmission of said data based upon said classification.

34. The system of claim 26, wherein said control logic and said data filter receive control signals from a separate control console.

35. The system of claim 34, wherein said control signals are communicated via a communication channel separate from that utilized in transmitting said tagged data.

36. The system of claim 35, wherein said communication channel comprises an Internet security protocol channel.

37. The system of claim 26, wherein said network interface further has control logic thereon for monitoring communication bandwidth utilization associated with said network interface and for decreasing communication of data associated with said network interface as a function of said monitored communication bandwidth utilization.

38. The system of claim 37, wherein said control logic comprises at least one data communication bandwidth threshold value.

39. The system of claim 38, wherein said control logic issues an alarm message to a separate management console when said monitored communication bandwidth utilization exceeds said at least one data communication bandwidth threshold value.

40. The system of claim 39, wherein said control logic decreasing said communication of data associated with said network interface is under control of a control signal provided by said management console responsive to said alarm message.

41. The system of claim 38, wherein said control logic decreasing said communication of data associated with said network interface is under autonomous control of said control logic.

42. The system of claim 37, wherein said control logic comprises a hierarchy of data communication bandwidth threshold values.

43. The system of claim 42, wherein said control logic issues an alarm message to a separate management console when said monitored communication bandwidth utilization exceeds said a first data communication bandwidth threshold value of said hierarchy of data communication bandwidth threshold values, and wherein said control logic autonomously decreases said communication of data associated with said network interface when said monitored communication bandwidth utilization exceeds a second data communication bandwidth threshold value of said hierarchy of data communication bandwidth threshold values.

44. The system of claim 37, wherein said control logic decreasing said communication of data associated with said network interface comprises disabling an input/output function of said network interface.

45. The system of claim 37, wherein said control logic decreasing said communication of data associated with said network interface comprises disabling a particular port of said network interface.

46. A method for controlling network data traffic, said method comprising:

monitoring communication bandwidth utilization associated with a network interface, wherein said monitoring is provided by control logic of said network interface; and

decreasing communication of data associated with said network interface as a function of said monitored communication bandwidth utilization.

47. The method of claim 46, further comprising:

providing said control logic with at least one data communication bandwidth threshold value for comparison to said monitored communication bandwidth utilization.

48. The method of claim 47, further comprising:

issuing an alarm message to a separate management console when said monitored communication bandwidth utilization exceeds said at least one data communication bandwidth threshold value.

49. The method of claim 48, wherein said decreasing said communication of data associated with said network interface is under control of a control signal provided by said management console responsive to said alarm message.

50. The method of claim 47, wherein said decreasing said communication of data associated with said network interface is under autonomous control of said control logic.

51. The method of claim 46, wherein said decreasing said communication of data associated with said network interface comprises:

disabling an input/output function of said network interface.

52. The method of claim 46, wherein said decreasing said communication of data associated with said network interface comprises:

disabling a particular port of said network interface.

53. The method of claim 46, further comprising:

tagging data communicated by said network interface with a preselected classification, wherein said tagging is provided by control logic of said network interface.

54. The method of claim 53, wherein said tagging said data comprises:

inserting a classification flag into a header block of a data packet associated with said data.

55. The method of claim 53 further comprising:

filtering data transmission in response to an analysis of said data for said classification.

56. A method for controlling network data traffic, said method comprising:

tagging data communicated by a network interface with a preselected classification, wherein said tagging is provided by control logic of said network interface;

analyzing said data for said classification, wherein said analyzing is performed at a network node separate from said network interface; and

allowing or preventing further communication of said data based upon said analysis.

57. The method of claim 56, wherein said tagging data communicated by said network interface comprises:

tagging all data transmitted by a host system associated with said network interface with the same said preselected classification.

58. The method of claim 56, wherein said tagging said data comprises:

inserting a classification flag into a header block of a data packet associated with said data.

59. The method of claim 56, wherein said network node is disposed at a network edge.

60. The method of claim 56, further comprising:

monitoring communication bandwidth utilization associated with said network interface; and

decreasing communication of data associated with said network interface as a function of said monitored communication bandwidth utilization.

61. The method of claim 60, further comprising:

comparing said monitored communication bandwidth utilization to at least one data communication bandwidth threshold value.