Methods, communication networks, and computer program products for monitoring, examining, and/or blocking traffic associated with a network element based on whether the network element can be trusted

• US 20070150582A1
• Filed: 12/22/2005
• Published: 06/28/2007
• Est. Priority Date: 12/22/2005
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Aaron, Jeffrey, Shrum, Edgar
• Granted Patent: US 8,224,952 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/1057 involving pre-assessment of levels of reputation of peers

Abstract

A communication network is operated by determining whether a network element can be trusted and monitoring traffic associated with the network element based on whether the network element can be trusted. At least some of the monitored traffic may be selected for examination based on the degree of trust for the network element. At least some of the monitored and/or examined traffic is selected to be blocked based on the degree of trust for the network element.

Claims

1. A method of operating a communication network, comprising:

determining whether a network element can be trusted; and

monitoring traffic associated with the network element based on whether the network element can be trusted.

2. The method of claim 1, wherein determining whether a network element can be trusted, comprises:

generating a first hash value based on data associated with the network element;

generating a second hash value based on the data associated with the network element; and

comparing the first hash value with the second hash value to determine whether the network element can be trusted.

3. The method of claim 2, wherein comparing the first hash value with the second hash value to determine whether the network element can be trusted comprises comparing the first hash value with the second hash value to determine a degree of trust for the network element.

4. The method of claim 1, wherein monitoring traffic comprises:

selecting traffic for monitoring using rules that are based on network element trust information.

5. The method of claim 4, wherein monitoring traffic further comprises:

specifying the traffic to be monitored based on traffic classification, a time duration, and/or a traffic amount.

6. The method of claim 4, wherein monitoring traffic further comprises:

monitoring the traffic using rules, pattern matching techniques, and/or deviation from expected values techniques to determine if the traffic contains unexpected information based on a degree of trust for the network element; and

providing results with respect to whether the traffic contains unexpected information to a human expert interface based on a degree of trust for the network element.

7. The method of claim 6, wherein monitoring traffic further comprises:

obtaining input via the human expert interface; and

revising the results with respect to whether the traffic contains unexpected information based on the obtained input.

8. The method of claim 4, further comprising:

selecting at least some of the monitored traffic for examination based on a degree of trust for the network element.

9. The method of claim 8, further comprising:

examining the selected at least some of the monitored traffic using rules, pattern matching techniques, and/or deviation from expected values techniques to determine if the traffic contains unexpected information based on the degree of trust for the network element; and

providing results with respect to whether the traffic contains unexpected information to a human expert interface based on the degree of trust for the network element;

wherein a level of examination of the at least some of the monitored traffic is based on the degree of trust for the network element.

10. The method of claim 9, wherein examining the selected at least some of the monitored traffic comprises:

obtaining input via the human expert interface; and

revising the results with respect to whether the traffic contains unexpected information based on the obtained input.

11. The method of claim 8, further comprising:

selecting at least some of the monitored and/or examined traffic to be blocked based on the degree of trust for the network element.

12. The method of claim 11, further comprising:

blocking the selected at least some of the monitored and/or examined traffic using filtering based on source/destination address, port, protocol, and/or state of a connection/session.

13. The method of claim 12, wherein blocking the selected at least some of the monitored and/or examined traffic comprises:

obtaining input via the human expert interface; and

permanently blocking the selected at least some of the monitored and/or examined traffic based on the obtained input.

14. The method of claim 11, further comprising:

modifying rules, pattern matching techniques, and/or deviation from expected values techniques used in monitoring the traffic and/or examination of at least some of the monitored traffic.

15. A computer program product for operating a communication network, comprising:

a computer readable storage medium having computer readable program code embodied therein, the computer readable program code being configured to carry out the method of claim 12.

16. A communication network, comprising:

a verification system that is configured to determine whether a network element can be trusted; and

a monitor that is connected to the verification system and is configured to monitor traffic associated with the network element based on whether the network element can be trusted.

17. The communication network of claim 16, further comprising:

a monitoring controller that is connected to the verification system and the monitor and is configured to select traffic for monitoring using rules that are based on the degree of trust for the network element.

18. The communication network of claim 17, further comprising:

an examiner that is connected to the monitor and is configured to select at least some of the monitored traffic for examination based on the degree of trust for the network element.

19. The communication network of claim 18, further comprising:

a blocking controller that is connected to the examiner and is configured to select at least some of the monitored and/or examined traffic to be blocked based on the degree of trust for the network element.

20. The communication network of claim 19, further comprising:

a human expert interface;

wherein the monitor is further configured to monitor the traffic using rules, pattern matching techniques, and/or deviation from expected values techniques to determine if the traffic contains unexpected information based on the degree of trust for the network element, and to provide results with respect to whether the traffic contains unexpected information based on the monitoring to the human expert interface based on the degree of trust for the network element; and

wherein the examiner is further configured to examine the selected at least some of the monitored traffic using rules, pattern matching techniques, and/or deviation from expected values techniques to determine if the traffic contains unexpected information based on the degree of trust for the network element, and to provide results with respect to whether the traffic contains unexpected information based on the examination to the human expert interface based on the degree of trust for the network element.