Method and apparatus for enhancing security of communications in a packet-switched data communications system
First Claim
1. In a packet-switched data communications system having a network with at least one data entry and display terminal for system users and at least one host data processor having a stored database for communicating with said terminal via plural data transmission paths of said network, wherein communication and processing of data is accomplished according to a pre-established protocol and data format and with preprogrammed software and wherein any user may obtain access from a terminal to the database associated with a selected processor for a data communications session therewith, the security improvement comprising:
- a terminal security means introduced into said system in data communicative relationship with said terminal and said network for generating an initial data packet including data identifing an authorized user and the address of the processor with the database to be accessed, in advance of at least one additional data packet containing message data to be processed by the addressed processor, said intial data packet generated in said format and compatible with said protocol but incompatible with said programmed software for processing by the addressed processor, said terminal security means includingmeans responsive to user-initiated data entry seeking access from a terminal for detecting whether the data entry includes user identify data, andmeans responsive to said detection for transmitting said initial data packet and said at least one additional data packet to the addressed processor via said network; and
a host security means introduced into said system in data communicative relationship with said network to intercept and process said initial data packet for allowing or denying the requested access according to whether any user identity data contained in the intercepted initial data packet designates the initiating user as authorized or unauthorized, respectively, to obtain the requested access, said incompatibility of said initial data packet rendering it and immediately following data packets unsuitable for processing by the addressed processor, whereby neither data contained in the initial data packet nor the message data contained in additional data packets immediately following said initial data packet can be processed by the addressed processor should said host security means fail for any reason to intercept said initial data packet, said host security means includingmeans for processing the intercepted initial data packet to detect any such user identity data contained therein,means responsive to detected user identity data for authenticating the authorization of the user therefrom, andmeans responsive to authentication of user authorization for generating an artificial data packet in place of said initial data packet, to render the immediately following data packets compatible with both said protocol and said preprogrammed software to enable the addressed processor to process the message data contained in said at least one additional data packet and to provide the requested access for a communications session with the authorized user.
1 Assignment
0 Petitions
Accused Products
Abstract
Security of communications in a packet-switched data communications system is enhanced by introducing terminal and host security devices into the system in communicative relationship with a terminal and a host processor, respectively. In response to a user-initiated data entry at the terminal, the terminal security device generates an initial data packet indicative of user authorization or not, but which is unsuited for processing by the addressed processor, ahead of additional data packets containing user-entered message data to be processed by the addressed processor. The host security device intercepts and processes the initial data packet and, if user authorization is indicated therein, replaces it with an artificial data packet solely to render the additional packets amenable to processing by the addressed processor and thereby to establish a communications session between user terminal and processor-associated database to which access was requested.
175 Citations
9 Claims
-
1. In a packet-switched data communications system having a network with at least one data entry and display terminal for system users and at least one host data processor having a stored database for communicating with said terminal via plural data transmission paths of said network, wherein communication and processing of data is accomplished according to a pre-established protocol and data format and with preprogrammed software and wherein any user may obtain access from a terminal to the database associated with a selected processor for a data communications session therewith, the security improvement comprising:
-
a terminal security means introduced into said system in data communicative relationship with said terminal and said network for generating an initial data packet including data identifing an authorized user and the address of the processor with the database to be accessed, in advance of at least one additional data packet containing message data to be processed by the addressed processor, said intial data packet generated in said format and compatible with said protocol but incompatible with said programmed software for processing by the addressed processor, said terminal security means including means responsive to user-initiated data entry seeking access from a terminal for detecting whether the data entry includes user identify data, and means responsive to said detection for transmitting said initial data packet and said at least one additional data packet to the addressed processor via said network; and a host security means introduced into said system in data communicative relationship with said network to intercept and process said initial data packet for allowing or denying the requested access according to whether any user identity data contained in the intercepted initial data packet designates the initiating user as authorized or unauthorized, respectively, to obtain the requested access, said incompatibility of said initial data packet rendering it and immediately following data packets unsuitable for processing by the addressed processor, whereby neither data contained in the initial data packet nor the message data contained in additional data packets immediately following said initial data packet can be processed by the addressed processor should said host security means fail for any reason to intercept said initial data packet, said host security means including means for processing the intercepted initial data packet to detect any such user identity data contained therein, means responsive to detected user identity data for authenticating the authorization of the user therefrom, and means responsive to authentication of user authorization for generating an artificial data packet in place of said initial data packet, to render the immediately following data packets compatible with both said protocol and said preprogrammed software to enable the addressed processor to process the message data contained in said at least one additional data packet and to provide the requested access for a communications session with the authorized user. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. In a packet-switched data communications system having a network for transmission of data packets, at least one data entry and display terminal for system users to enter data into said network in packets addressed to a selected destination, and at least one host data processor having a stored database for communicating with said terminal in response to data received in said packets from said terminal through said network, wherein communication and processing of data is accomplished according to a pre-established protocol and data format and with preprogrammed software and wherein any user may obtain access from a terminal to the database associated with a selected processor for a data communications session therewith, the method of upgrading security to permit such access only to pre-authorized users, comprising:
-
generating from a terminal security device associated with said terminal, in response to a user-initiated data entry at said terminal seeking access to a database, a preconfigured initial data packet incompatible with said programmed software and containing data designating whether the user is authorized and the address of the processor having the database to which access is requested, followed by at least one additional data packet containing message data conforming to user-initiated data entry to be processed by the addressed processor, said step of generating including detecting from said user-initiated data entry the presence or absence of data therein identifying the user as an authorized user, and inputting said initial data packet followed by said at least one additional data packet into said network for transmission to the addressed processor; and intercepting at a host security device connected to said network in advance of and associated with the addressed processor the initial data packet to preclude its receipt by the addressed processor, and thereupon allowing or denying the requested access at the host security device according to whether data identifying the user as authorized is present in or absent from the intercepted initial data packet, respectively, said step of allowing or denying including detecting user identify data in the intercepted initial data packet, authenticating the authorization of the user from the detected user identity data, and upon authentication, delivering an artificial data packet to the addressed processor in lieu of said intercepted initial data packet solely to develop a proper data sequence for compatibility of said at least one additional data packet with said protocol, format and preprogrammed software for processing therewith, said incompatibility of said initial data packet rendering it and immediately following data packets unsuited for processing by the addressed processor, whereby the data contained in said initial data packet and the message data in the immediately following data packets could not be processed by the addressed processor if the initial data packet were not intercepted; and establishing at said host security device direct data communications between the addressed processed and the authorized user terminal immediately after the artificial data packet is delivered. - View Dependent Claims (8, 9)
-
Specification