Geographic filter for regulating inbound and outbound network communications

• US 9,537,825 B2
• Filed: 11/11/2013
• Issued: 01/03/2017
• Est. Priority Date: 01/26/2006
• Status: Active Grant

• Current Assignee: ioRhythm, Inc.
• Original Assignee: ioRhythm, Inc.
• Inventors: Kudla, Aaron J., Cain, Shelby, Stracener, Tom, Luck, Marce Wayne
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US14/077,116
• Publication Number:
  US 20140075540A1
• Time in Patent Office: 1,149 Days
• Field of Search: 455/456.3, 709/238
• US Class Current: 1/1
• CPC Class Codes: G06F 2203/04806 Zoom, i.e. interaction techniques or interactors for controlling the zooming operation
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal

Abstract

A system and method for regulating and analyzing inbound and outbound communications in and between computer networks on the basis of geographic security assertions are provided. Geographic information is collected, optimized, and shared between network objects to enforce network access control on the basis of configurable security assertions. Security assertions are configured and metrics displayed using maps and other geographic data in a graphical user interface.

Claims

1. A device for filtering geographic country of origin information transmitting on a network comprising:

a first network object capable of receiving information from or transmitting information to a second network object;

a geographic filtering engine wherein all communication between said first network object and said second network object must pass through said geographic filter engine, comprising;

a configuration post-processing engine wherein at least one algorithm is applied to at least one geographic country of origin association between a network protocol attribute and geographic country of origin location;

a rules abstraction module wherein;

a memory structure stores a set of persistent geographic country of origin associations; and

at least one compact representation of a security assertion is derived from said set of persistent geographic country of origin associations;

an associative module performing at least one data process operating to associate a geographic country of origin location pertaining to each network protocol attribute;

a dispatch module wherein at least one network protocol attribute of said second network object is extracted and compared to said compact representation of a security assertion and the result is provided to the geographic filter control module; and

a network filtering engine wherein a device action is triggered based on the results provided by said dispatch module, wherein the device action is selected from;

configured to allow the receipt or transmission of information between said first network object and said second network object;

configured to block the receipt or transmission of information between said first network object and said second network object;

configured to allow the receipt of information from said second network object to a third network object determined by said geographic filter engine; and

configured to allow the transmission of information from said third network object to said second network object determined by said geographic filter engine.

2. The device of claim 1, wherein said algorithm is a conversion algorithm.

3. The device of claim 1, wherein said algorithm is an optimizing algorithm.

4. The device of claim 1, wherein said algorithm is a compression algorithm.

5. The device of claim 1, wherein said algorithm is a parsing algorithm.

6. The device of claim 1, wherein said algorithm is an encoding algorithm.

7. The device of claim 1, wherein said algorithm is a size comparison algorithm.

8. The device of claim 2, wherein said conversion algorithm comprises a compression algorithm.

9. The device of claim 2, wherein said conversion algorithm comprises a 32-bit start-end format, wherein said network protocol attribute is converted into or out of a 32-Bit integer being the start address, and a number corresponding to the number of contiguous IP address.

10. The device of claim 2, wherein said conversion algorithm comprises a range notation, wherein said network protocol attribute is converted into or out of a range notation.

11. The device of claim 10, wherein said range notation comprising a dotted-quad format.

12. The device of claim 11, wherein said dotted-quad format comprises a dash within said dotted-quad format.

13. The device of claim 2, wherein said conversion algorithm comprises a Classes Inter Domain Routing (UDR) representation.

14. The device of claim 3, wherein said optimizing algorithm comprises a combining of contiguous network ranges.

15. The device of claim 1, wherein said geographic filtering engine further comprising a storage module wherein computer readable data is stored.

16. The device of claim 15, wherein said storage module comprising a database.

17. The device of claim 15, wherein said storage module comprising a file-system.

18. The device of claim 1, wherein the contextual property of said memory structure is a whitelist.

19. The device of claim 1, wherein the contextual property of said memory structure is a blacklist.

20. The device of claim 1, wherein said compact representation of geographic security assertion is a table structure.