Methods, communication networks, and computer program products for monitoring, examining, and/or blocking traffic associated with a network element based on whether the network element can be trusted

• US 8,380,847 B2
• Filed: 06/14/2012
• Issued: 02/19/2013
• Est. Priority Date: 12/22/2005
• Status: Expired due to Fees

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Aaron, Jeffrey, Shrum, Edgar Jr.
• Primary Examiner(s): Salad, Abdullahi
• Assistant Examiner(s): Keehn, Richard G
• Application Number:
  US13/523,332
• Publication Number:
  US 20120272291A1
• Time in Patent Office: 250 Days
• Field of Search: 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/1057 involving pre-assessment of levels of reputation of peers

Abstract

A communication network is operated by determining whether a network element can be trusted and monitoring traffic associated with the network element based on whether the network element can be trusted. At least some of the monitored traffic may be selected for examination based on the degree of trust for the network element. At least some of the monitored and/or examined traffic is selected to be blocked based on the degree of trust for the network element.

Claims

1. A method of operating a communication network, comprising:

determining whether a network element can be trusted, wherein determining whether a network element can be trusted comprises;

generating a first hash value based on data associated with the network element at a first time;

generating a second hash value based on the data associated with the network element at a second time different than the first time; and

comparing the first hash value with the second hash value to determine whether the network element can be trusted based on whether a change has occurred in a configuration of the network element between the first time and the second time; and

monitoring traffic associated with the network element based on whether the network element can be trusted;

wherein monitoring traffic comprises;

monitoring the traffic using rules to determine if the traffic contains unexpected information based on a degree of trust for the network element; and

providing results with respect to whether the traffic contains unexpected information to a human expert interface based on the degree of trust for the network element;

wherein monitoring traffic further comprises;

selecting the traffic for monitoring using rules that are based on network element trust information;

selecting at least some of the traffic that was monitored for examination based on a degree of trust for the network element;

examining the at least some of the traffic that was monitored and was selected using rules using a level of examination selected from a plurality of levels of examination to determine if the traffic contains unexpected information based on the degree of trust for the network element; and

providing results with respect to whether the at least some of the traffic that was monitored and was selected using rules contains unexpected information to a human expert interface based on the degree of trust for the network element;

wherein the level of examination of the at least some of the traffic that was monitored is based on the degree of trust for the network element.

2. The method of claim 1, wherein comparing the first hash value with the second hash value to determine whether the network element can be trusted comprises comparing the first hash value with the second hash value to determine a degree of trust for the network element.

3. The method of claim 1, wherein examining the at least some of the traffic comprises:

obtaining input via the human expert interface; and

revising the results with respect to whether the traffic contains unexpected information based on the input.

4. The method of claim 1, wherein monitoring traffic further comprises:

specifying the traffic to be monitored based on traffic classification.

5. The method of claim 1, wherein monitoring traffic further comprises:

obtaining input via the human expert interface; and

revising the results with respect to whether the traffic contains unexpected information based on the input.

6. The method of claim 1, further comprising:

selecting at least some of the traffic that was monitored to be blocked based on the degree of trust for the network element.

7. The method of claim 6, further comprising:

blocking the at least some of the traffic that was monitored and was selected using filtering based on source address.

8. The method of claim 7, wherein blocking the at least some of the traffic that was monitored and was selected comprises:

obtaining input via the human expert interface; and

permanently blocking the at least some of the traffic that was monitored and was selected based on the input.

9. The method of claim 6, further comprising:

modifying rules used in monitoring the traffic.

10. The method of claim 1, wherein the network element is a communications device comprising a router.

11. A communication network, comprising:

a verification system comprising at least one processor that is to determine whether a network element can be trusted by;

generating a first hash value based on data associated with the network element at a first time;

generating a second hash value based on the data associated with the network element at a second time different than the first time;

comparing the first hash value with the second hash value to determine whether the network element can be trusted based on whether a change has occurred in a configuration of the network element between the first time and the second time; and

a monitor comprising at least one processor that is connected to the verification system and is to monitor traffic associated with the network element based on whether the network element can be trusted;

a monitoring controller comprising at least one processor that is connected to the verification system and the monitor and is to select traffic for monitoring using rules that are based on a degree of trust for the network element;

an examiner comprising at least one processor that is connected to the monitor and is to select at least some of the traffic that was monitored for examination based on the degree of trust for the network element; and

a human expert interface;

wherein the monitor is further to monitor the traffic using rules to determine if the traffic contains unexpected information based on a degree of trust for the network element, to provide results with respect to whether the traffic contains unexpected information to a human expert interface based on the degree of trust for the network element, to select the traffic for monitoring using rules that are based on network element trust information, to select at least some of the traffic that was monitored for examination based on a degree of trust for the network element, to examine the at least some of the traffic that was monitored and was selected using rules using a level of examination selected from a plurality of levels of examination to determine if the traffic contains unexpected information based on the degree of trust for the network element and to provide results with respect to whether the at least some of the traffic that was monitored and was selected using rules contains unexpected information to a human expert interface based on the degree of trust for the network element;

wherein the level of examination of the at least some of the traffic that was monitored is based on the degree of trust for the network element.

12. The communication network of claim 11, further comprising:

a blocking controller comprising at least one processor that is connected to the examiner and is to select at least some of the traffic that was monitored to be blocked based on the degree of trust for the network element.

13. A communications network according to claim 11, wherein the network element is a communications device comprising a router.

14. A computer program product for operating a communication network, comprising:

a non-transitory computer readable medium having computer readable program code stored thereon, the computer readable program code comprising;

computer readable program code to determine whether a network element can be trusted, wherein the computer readable program code to determine whether a network element can be trusted comprises;

computer readable program code to generate a first hash value based on data associated with the network element at a first time;

computer readable program code to generate a second hash value based on the data associated with the network element at a second time different than the first time; and

computer readable program code to compare the first hash value with the second hash value to determine whether the network element can be trusted based on whether a change has occurred in a configuration of the network element between the first time and the second time; and

computer readable program code to monitor traffic associated with the network element based on whether the network element can be trusted;

wherein the computer readable program code to monitor traffic comprises;

computer readable program code to monitor the traffic using rules to determine if the traffic contains unexpected information based on a degree of trust for the network element; and

computer readable program code to provide results with respect to whether the traffic contains unexpected information to a human expert interface based on the degree of trust for the network element;

wherein the computer readable program code to monitor traffic further comprises;

computer readable program code to select the traffic for monitoring using rules that are based on network element trust information;

computer readable program code to select at least some of the traffic that was monitored for examination based on a degree of trust for the network element;

computer readable program code to examine the at least some of the traffic that was monitored and was selected using rules using a level of examination selected from a plurality of levels of examination to determine if the traffic contains unexpected information based on the degree of trust for the network element; and

computer readable program code to provide results with respect to whether the at least some of the traffic that was monitored and was selected using rules contains unexpected information to a human expert interface based on the degree of trust for the network element;

wherein the level of examination of the at least some of the traffic that was monitored is based on the degree of trust for the network element.