Network security architecture for a mobile network platform

• US 6,947,726 B2
• Filed: 11/19/2001
• Issued: 09/20/2005
• Est. Priority Date: 08/03/2001
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Rockwell, Laurence I.
• Primary Examiner(s): PEREZ GUTIERREZ, RAFAEL
• Application Number:
  US09/992,377
• Publication Number:
  US 20030027551A1
• Time in Patent Office: 1,401 Days
• Field of Search: 455/410, 455/411, 455/431, 455/404.1, 455/404.2, 455/414.1, 340/945, 340/541, 709/223, 709/224, 709/225, 713/200, 713/201, 713/153, 713/154, 713/164
• US Class Current: 455/411
• CPC Class Codes: B64D 11/0015 Arrangements for entertainment or communications, e.g. radio, television
• CPC Class Codes: B64D 11/00155 Individual entertainment or communication system remote controls therefor, located in or connected to seat components, e.g. to seat back or arm rest
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 84/06 Airborne or Satellite Networks space-based or airborne stations H04B7/185

Abstract

A mobile platform security architecture is provided for monitoring security activities associated with a network residing on an aircraft. The security architecture includes a plurality of passenger connections to the network, such that each of the passenger connections has an enforced network address and is disposed in proximate location to a passenger seating area; an intrusion detection system connected to the network and operable to detect a security intrusion event whose origination is associated with network; and an airborne security manager connected to the network and adapted to receive the security intrusion event from the intrusion detection system. The security architecture is further operable to perform a security response in accordance with a security policy, where the security response is directed to at least one of the passenger connections.

Claims

1. A network security architecture for monitoring security activities in a mobile network platform, comprising:

a mobile network residing on the mobile network platform, the mobile network includes a plurality of user access points;

an address manager residing on the mobile network platform and operable to dynamically assign a network address to any one of the plurality of the user access points;

a security response actuator associated with each of the plurality of user access points, each security response actuator is operable to enforce an association of a network address with an assigned user access point;

an intrusion detection system connected to the mobile network and residing on the mobile network platform, the intrusion detection system operable to detect a security intrusion event that is associated with a first user access point from the plurality of user access points; and

a mobile security manager residing on the mobile network platform, the mobile security manager is adapted to receive the security intrusion event from the intrusion detection system and operable to issue a security response command in response to the security intrusion event, where the security response command is directed to said first user access point.

2. The network security architecture of claim 1 wherein the security response actuator associated with the first user access point is adapted to receive the security response command from the security manager and operable to perform security response activities in response to the security response command.

3. The network security architecture of claim 2 wherein the security response actuator associated with the first user access point is operable to prevent transmission of data packets to the first user access point, where the data packets are not associated with the first user access point.

4. The network security architecture of claim 2 wherein each security response actuator enforces an association of a network address with an assigned user access point when a computing device is in data communication with the assigned user access point.

5. The network security architecture of claim 2 wherein the security response actuator associated with the first user access point is operable to prevent transmission of data packets from the first user access point.

6. A method for monitoring security activities associated with a network residing in a mobile network platform, comprising:

providing a plurality of user access points to the network;

dynamically assigning a network address to one of the plurality of the user access points and enforcing an association of the network address with said one of the plurality of assigned user access points;

detecting a security intrusion event whose origination is associated with one of the plurality of user access points; and

performing a security response activity in response to the detected security intrusion event, when the security response activity is directed to said one of the plurality of user access points.