Advanced data guard having independently wrapped components

• US 6,584,508 B1
• Filed: 12/30/1999
• Issued: 06/24/2003
• Est. Priority Date: 07/13/1999
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Thomas, Linda, Epstein, Jeremy
• Primary Examiner(s): Lim, Krisna
• Assistant Examiner(s): Choudhary, Anita
• Application Number:
  US09/475,944
• Time in Patent Office: 1,272 Days
• Field of Search: 709/217, 709/225, 709/227-229, 713/200, 713/201
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A system and method for increasing the security of a data guard is disclosed. The data guard is based on a multi-part proxy that includes a first proxy agent that communicates with an inside computer network region, a second proxy agent that communicates with an outside computer network region, and a content-based filter application that reviews information that is passed between the first proxy agent and the second proxy agent. Both the first and second proxy agents can be based on existing firewall proxies. The proxy agents listen for protocol operations (e.g., IIOP requests or replies) and translate those protocol operations into protocol-independent data. The protocol independent data is then analyzed by a protocol-independent content-based filter. The behavior of the multi-part proxy can be further constrained through the use of software wrapper technology.

Claims

1. A computer system that defines a security barrier between a first computer network region and a second computer network region, the computer system comprising:

a graphical user interface for presenting a template to a user and receiving content limitations via said template of said graphical user interface, said content limitations including rules and values;

a first proxy agent running on the computer system, said first proxy agent being operative to communicate with a first computer network region;

a second proxy agent running on the computer system, said second proxy agent being operative to communicate with a second computer network region;

a content-based filter application running on the computer system, said content-based filter application being operative to review information that is passed between said first proxy agent and said second proxy agent, wherein the manner in which said content-based filter application reviews said information is user-configurable utilizing said content limitations received via said template of said graphical user interface;

one or more software wrappers that are operative to constrain behavior of said first proxy agent, said second proxy agent, and said content-based filter application;

wherein said first proxy agent and said second proxy agent are application level proxy agents;

wherein said content-based filter application is a protocol-independent analysis application;

wherein said first proxy agent and said second proxy agent generate and pass files to said content-based filter application;

wherein said files include extensible markup language code;

wherein said first proxy agent and said second proxy agent pass information to said content-based filter application using shared memory;

wherein said content-based filter application modifies said information based on said review;

wherein components that are positioned between said first and sad second proxy agents and said content-based filter application;

are queued and dequeued;

wherein said first proxy agent, said second proxy agent, and said content-based filter application are running on a commercial off the shelf operating system;

wherein said content-based filter application generates application-specific alerts for an intrusion detection system in response to said review based on said rules and said values of said content limitations.

2. The computer system of claim 1, wherein said application-specific alerts are user-configured.

3. The computer system of claim 1, wherein said content limitations are reviewed to ensure that said content limitations meet organizational security requirements.

4. The computer system of claim 1, wherein said content limitations relate to a monetary transaction.

5. The computer system of claim 4, wherein said content limitations relate to a bank transaction.