Security system for preventing unauthorized packet transmission between customer servers in a server farm

• US 7,359,378 B2
• Filed: 10/02/2002
• Issued: 04/15/2008
• Est. Priority Date: 10/11/2001
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Gayrard, Patrick, Chauffour, Pascal, Lebrun, Eric, Berthaud, Jean-Marc
• Primary Examiner(s): Kizou; Hassan
• Assistant Examiner(s): LEE, BETTY E
• Application Number:
  US10/263,213
• Publication Number:
  US 20030072307A1
• Time in Patent Office: 2,022 Days
• Field of Search: 726/2, 726/3, 726/4, 726/11, 726/13, 726/21, 370/389, 370/401, 709/223, 709/224, 709/225
• US Class Current: 370/389
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2408 for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A security system for a communication system that includes an IP network and groups of servers in a farm, wherein each group is associated with a customer. A user connected to the network can access information provided by a customer from a server within the group of servers associated with this customer through a dispatching device. The security system comprises setting means in each of the switches which are located between the dispatching device and the customer servers for setting a field of bits in the IP header of potentially irregular packets transmitted from a customer server and the dispatching device, means in the dispatching device for identifying any packet wherein the field of bits has been set to the predefined value, and means for deleting or logging the potentially irregular packet when the destination of the packet is not the dispatching device.

Claims

1. A security system in a communication system including an IP network and a plurality of groups of servers in a server farm, each of said groups being associated with a customer, and wherein a user connected to said IP network can access information provided by a customer from a server within the group of servers associated with said customers through a dispatching device adapted to select a server amongst the servers of said group of servers according to a predefined algorithm, said dispatching device being connected to the servers through switches adapted to control the data transmission exchanged between said dispatching device and said servers, said security system comprising:

setting means in each one of said switches for setting, to a predefined value, a field of bits in an IP header of a potentially irregular packet transmitted from a customer server;

identifying means in said dispatching device for identifying any packet wherein said field of bits has been set to said predefined value;

relaying means for relaying a packet from a server in the server farm to a user via the Internet in the case that the packet is not identified as a potentially irregular packet; and

disposing means for disposing said potentially irregular packet as being an irregular packet because the destination of such a packet is a server in the server farm.

2. The security system according to claim 1, wherein said field of bits in the IP header is the TOS bits field.

3. The security system according to claim 1, wherein a destination of the potentially irregular packet includes a server in the server farm.

4. The security system according to claim 1, wherein said disposing means are within said dispatching device and are used to delete any packet considered to be an irregular packet.

5. The security system according to claim 1, further comprising a logging device connected to said dispatching device for logging any packet considered to be an irregular packet.

6. The security system according to claim 5, wherein said setting means are located in each one of said switches at the input ports linked to said customer servers.

7. The security system according to claim 1, wherein input ports of said switches which are linked to said dispatching device include also setting means for setting said field of bits in the IP header of any potentially irregular packet transmitted from said dispatching device and a customer server.