Systems and methods for enhanced network security

• US 8,065,725 B2
• Filed: 05/30/2003
• Issued: 11/22/2011
• Est. Priority Date: 05/30/2003
• Status: Active Grant

• Current Assignee: Calyptix Security
• Original Assignee: Calyptix Security
• Inventors: Teo, Lawrence Chin Shiun, Zheng, Yuliang
• Primary Examiner(s): Abrishamkar; Kaveh
• Application Number:
  US10/543,600
• Publication Number:
  US 20060069912A1
• Time in Patent Office: 3,098 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Systems and methods for an information system security infrastructure are described. One embodiment of the present invention comprises global Internet-scale defense infrastructure, referred to as the Intrusion Detection Force (IDF). The IDF comprises a virtual infrastructure implemented on top of an existing network, such as the Internet. The IDF enables secure information sharing and intelligent data analysis and response. The node (e.g. 102 of FIG. 1) is the most primitive entity in the IDF architecture, and may be a switch, router, server, or workstation. The IDF may be implemented in small networks of computers or may be utilized by millions of hosts throughout the Internet, spanning different organizations, countries, and continents.

Claims

1. A node infrastructure implemented in a resident memory of at least one computing device on top of an existing computer network comprising:

a) a plurality of nodes arranged in a collective configured in a ring topology wherein there are at least two independent collectives in a zone of the computer network, each node comprising a host and a security agent capable of being executed on the host configured to identify data about an attack on the node;

b) a plurality of super nodes arranged in a first super collective having authority of the zone of the computer network and configured in a ring topology having the at least two independent collectives in the zone associated with the first super collective each super node comprising a host and software capable of analyzing data received from a node in an associated collective about an attack on the node and sharing the data with other super nodes in the super collective;

c) wherein each collective directly delivers data to an associated super node in the associated super collective; and

d) wherein each node can only share data between nodes in its collective and its associated super node in the associated super collective.

2. The infrastructure according to claim 1 wherein the super nodes provide higher level services to the associated collectives in a hierarchical manner.

3. The infrastructure according to claim 1 wherein nodes within a collective can exchange data to minimize the loss of the data in the event of a host crash or a denial-of-service attack.

4. The infrastructure according to claim 1 wherein there are two node infrastructures each infrastructure having authority over a separate zone which are associated for the purpose of sharing data through a super node in each of their respective super collectives.

5. The infrastructure according to claim 1 wherein the super collective is able to identify an attack that occurs on nodes in different collectives.

6. The infrastructure according to claim 1 wherein the super collective is capable of detecting if data originated from a node in an associated collective.

7. The infrastructure according to claim 1 wherein a collective only has one associated super collective.

8. The infrastructure according to claim 1 wherein a super node shares data with a collective other than the collective where data was initially received from.

9. The infrastructure according to claim 1 wherein a node in a collective can share data with more than one super node in an associated super collective.

10. The infrastructure according to claim 1 wherein in the event one or more nodes in a collective become inactive or unavailable due to maintenance, hardware failure/software failure, or denial-of-service attack the remaining active nodes in a collective can reconstruct the ring topology of the collective to continue sharing data.

11. The infrastructure according to claim 1 wherein in the event one or more super nodes become inactive or unavailable due to maintenance, hardware failure/software failure, or denial-of-service attack the remaining active super nodes in the super collective can reconstruct the ring topology of the super collective to continue sharing data.