Improving security of data communications networks

• US 7,716,717 B2
• Filed: 11/06/2006
• Issued: 05/11/2010
• Est. Priority Date: 07/25/2000
• Status: Expired due to Term

• Current Assignee: Cufer Asset Ltd LLC (Intellectual Ventures LLC)
• Original Assignee: Tri Mbc Communications LLC (Intellectual Ventures LLC)
• Inventors: Green, Stuart D., Brown, Scott G., Myers, Jeffrey Van, Crain, Jonathan M., Perry, Carl A., Yax, Marcus L.
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US11/593,226
• Publication Number:
  US 20070136791A1
• Time in Patent Office: 1,282 Days
• Field of Search: None
• US Class Current: 726/1
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A FireNet security system in which trustworthy networks, called BlackNets, each comprising One (1) or more client computers, are protected by FireBreaks against attacks from untrustworthy networks, called RedNets. All incoming transactions from the RedNet are examined by the FireBreak to determine if they violate any of a plurality of protection rules stored in a local protection rules database. Any transaction found to be in violation is discarded. Valid transactions are forwarded to the BlackNet. If an otherwise valid transaction is found to be suspicious, the FireBreak will forward to a FireNet Server relevant information relating to that transaction. If the FireNet Server verifies that the transaction is indeed part of an attack, the FireNet Server will create new protection rules suitable to defend against the newly identified source or strategy of attack. Periodically, all FireBreaks in the FireNet system will transfer, directly or indirectly, all new rules.

Claims

1. A communications security system to prevent transfer of selected communication transactions from an untrustworthy network to a trustworthy network, comprising:

a server, connected to the untrustworthy network, configured to maintain a plurality of protection rules, each of which, when applied to a communication transaction, identifies that communication transaction to be a respective one of the selected communication transactions; and

a portal, connected between the untrustworthy network and the trusted network, that is configured to;

cooperate with the server to transfer the plurality of protection rules from the server to the portal via the untrustworthy network;

receive a communication transaction from the untrustworthy network for transfer to the trustworthy network;

apply one or more of the protection rules to the received communication transaction; and

selectively transfer to the server at least a portion of the received communication transaction via the untrustworthy network if a protection rule identifies the received communication transaction to be a respective one of the selected communication transactions.

2. The communications security system of claim 1 wherein the server is further configured to create a new protection rule based on the transferred portion of the communication transaction and transfer the newly created protection rule to the portal.

3. The communications security system of claim 2 wherein the server is further configured to employ an expert system to analyze the transferred portion of the communication transaction to create the new protection rule.

4. The communications security system of claim 1 wherein the protection rule is of a guard class.

5. A portal for use in a communications security system to selectively transfer a communication transaction in accordance with a protection rule maintained by a server, the portal having a computer-readable storage medium storing computer-executable instructions that, when executed, perform a method comprising:

receiving the protection rule from the server;

receiving the communication transaction;

applying the protection rule to the received communication transaction;

preventing the transfer of the received communication transaction if required by the protection rule; and

selectively transferring to the server at least a portion of the received communication transaction even if the protection rule allows transfer of the received communication transaction.

6. The portal of claim 5 wherein the method further comprises receiving from the server a newly created protection rule based on the transferred portion of the received communication transaction.

7. The portal of claim 5 wherein the portion of the received communication transaction is transferred if the protection rule is of a guard class.

8. The portal of claim 5 wherein if the protection rule is of an exclusion class, the received communication transaction is not transferred to a trustworthy network.

9. The portal of claim 8 wherein if the protection rule is of a guard class, the received communication transaction is transferred to a trustworthy network and a portion of the received communication transaction is transferred to the server.

10. The portal of claim 5 wherein the method further comprises asserting a warning signal.

11. The portal of claim 5 wherein the method further comprises re-directing the communication transaction to a specified computing device.

12. The portal of claim 5 wherein the protection rule has a specified lifetime.

13. A communications security method performed by a portal having a processor wherein the portal selectively transfers a communication transaction in accordance with a first protection rule maintained by a server, comprising:

receiving the first protection rule from the server;

receiving the communication transaction;

applying the first protection rule to the communication transaction;

preventing the transfer of the communication transaction if required by the first protection rule;

selectively transferring to the server at least a portion of the communication transaction even if the first protection rule allows transfer of the communication transaction; and

causing the server to selectively create a second protection rule in response to the portion of the communication transaction.

14. A communications security method, comprising:

transferring a first protection rule to a portal;

receiving from the portal, upon application by the portal of the first protection rule, at least a portion of a communication transaction the portal received from a device of an untrustworthy network;

determining whether a second protection rule should be created based on the received portion of a communication transaction; and

if the second protection rule should be created, creating the second protection rule; and

transferring the created second protection rule to the portal.

15. The method of claim 14 wherein the portion of the received communication transaction is received when the first protection rule is of a guard class.

16. The method of claim 14 wherein if the first protection rule is of a guard class, the communication transaction is also transferred to a trustworthy network.

17. The method of claim 14 wherein the method further comprises re-directing the received communication transaction to a specified computing device.

18. The method of claim 14 wherein the second protection rule has a specified lifetime.

19. The method of claim 18 further comprising specifying the lifetime of the second protection rule.

20. The method of claim 18 further comprising reviving the lifetime of the second protection rule.

21. The method of claim 18 wherein the lifetime does not expire.

22. The method of claim 14 wherein the determining includes employing an expert system.

23. A communications security system to prevent transfer of selected communication transactions from an untrustworthy network to a trustworthy network, comprising:

a portal, connected between the untrustworthy network and the trusted network, that is configured to;

cooperate with a server to transfer the plurality of protection rules from the server to the portal via the untrustworthy network, wherein the server is connected to the untrustworthy network and is configured to maintain a plurality of protection rules, each of which, if applied to a communication transaction, identifies that communication transaction to be a respective one of the selected communication transactions;

receive a communication transaction from the untrustworthy network for transfer to the trustworthy network;

apply one or more of the protection rules to the received communication transaction; and

selectively transfer to the server at least a portion of the received communication transaction via the untrustworthy network if a protection rule identifies the received communication transaction to be a respective one of the selected communication transactions.

24. A communications security system to prevent transfer of selected communication transactions from an untrustworthy network to a trustworthy network, comprising:

a server, connected to the untrustworthy network, configured to;

maintain a plurality of protection rules, each of which, when applied to a communication transaction, identifies that communication transaction to be a respective one of the selected communication transactions; and

receive a portion of a communication transaction received by a portal and

determined by the portal to be a respective one of selected communication transactions

determine whether the communication transaction is part of an attack; and

if the communication transaction is part of an attack, create a new protection rule based on the communication transaction.

25. A computer-readable storage medium storing computer-executable instructions, the instructions comprising:

receiving a protection rule from a server;

receiving a communication transaction;

applying the protection rule to the received communication transaction;

preventing transfer of the received communication transaction if required by the protection rule; and

selectively transferring to the server at least a portion of the received communication transaction even if the protection rule allows transfer of the received communication transaction.

26. A computer-readable storage medium storing computer- executable instructions, the instructions comprising:

transferring a first protection rule to a portal;

receiving from the portal, upon application by the portal of the first protection rule, at least a portion of a communication transaction the portal received from a device of an untrustworthy network

determining whether a second protection rule should be created based on the received portion of a communication transaction; and

if the second protection rule should be created, creating the second protection rule; and

transferring the created second protection rule to the portal.