Network traffic flow control system

• US 20030182580A1
• Filed: 02/21/2003
• Published: 09/25/2003
• Est. Priority Date: 05/04/2001
• Status: Abandoned Application

• Current Assignee: Jai-Hyoung Lee
• Original Assignee: Jai-Hyoung Lee
• Inventors: Lee, Jai-hyoung
• Application Number:
  US10/362,498
• Publication Number:
  US 20030182580A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

The present invention relates to a network traffic flow control system, more specifically to a system which separates networks physically and controls the flow of packets moving on the computer networks at the data link level without changing the constitution and environment of current network.

Claims

1. A network traffic flow control system installed between two or more broadcasting based networks is connected to one or more intrusion cut off systems that determine whether or not to cut off transmission/receiving of the packets between said networks in accordance with predetermined rules, and is connected to one or more intrusion detecting systems that monitors flow of the packets between said networks in accordance with predetermined rules, comprising:

an internal interface for transmitting/receiving the packets while connected to the internal network;

an external interface for transmitting/receiving the packets while connected to the external network;

a rule inquiring and filtering module which determines whether or not to cut off the packets received from said internal interface or said external interface determines in accordance with predetermined rules, while it is connected to said internal interface, said external interface, and said intrusion cut off system; and

a mirroring interface, which mirrors selectively the packets received from said internal interface or said external interface to said intrusion detecting system in accordance with predetermined rules, while it is connected to said internal interface, said external interface, and said intrusion detecting system,

wherein said predetermined rules in said rule inquiring and filtering module and in said mirroring interface control flow of the packets on the data link layer.

2. The network traffic flow control system as set forth in claim 1, further comprising:

a NAT which translates the address system of said internal network into the address system of said internal network, and vice versa, while inserted between said rule inquiring and filtering module and said external interface.

3. The network traffic flow control system as set forth in claim 1 or claim 2, wherein each of said internal interface and the external interface comprises:

a receiving buffer part for storing temporarily the packets received from said internal network or said external network, respectively;

a transmission buffer part for storing temporarily the packets to be transmitted to said internal network or said external network, respectively; and

a flow control rule database, which stores rules for determining whether or not to mirror the packets stored in said receiving buffer part to said mirroring interface,

whereby said receiving buffer part determines whether or not to mirror the packets stored in said internal network or said external network with reference to said flow control rule database, and then, transmits the corresponding packet to said mirroring interface in a case that the mirroring rule has been declared, while it transmits the corresponding packet to said rule inquiring and filtering module or to said NAT, in a case that no mirroring rule has been declared; and

said transmission buffer part determines whether or not to mirror the packets received from said rule inquiring and filtering module or said NAT with reference to said flow control rule database, and then, transmits the corresponding packet to said mirroring interface in a case that the mirroring rule has been declared, while it transmits the corresponding packet to said internal network or to said external network, in a case that no mirroring rule has been declared

4. The network traffic flow control system as set forth in claim 3, wherein said mirroring interface comprises:

a shared memory part for storing temporarily the packets mirrored from said internal interface or said external interface;

a transmission packet administration part for fetching the packets from said shared memory part to subsequently transmit the same to said network interface;

a network interface for receiving the packets from said transmission packet administration part to subsequently transmit the same to said intrusion detecting system; and

a receiving packet administration part for transmitting the received packets to said rule inquiring and filtering module if the packet has been received from said intrusion detecting system through said network interface.

5. The network traffic flow control system as set forth in claim 1 or claim 2, further comprising a communication/administration interface comprising:

a first communication module, which enables the clients to access;

a second communication module, which enables access to the intrusion cut off system;

a rule database, which stores predetermined intrusion cut off rules and intrusion detecting rules, and transmits the same to said rule inquiring and filtering module;

a log database for storing records on all packets passing the network; and

a statistics database for storing various statistical information of the packets in the network.

6. The network traffic flow control system as set forth in claim 4, further comprising a communication/administration interface comprising:

a first communication module, which enables the clients to access;

a second communication module, which enables access to the intrusion cut off system;

a rule database, which stores predetermined intrusion cut off rules and intrusion detecting rules, and transmits the same to said rule inquiring and filtering module;

a log database for storing records on all packets passing the network; and

a statistics database for storing various statistical information of the packets in the network.

7. The network traffic flow control system as set forth in claim 5, wherein said packet cut off rules are distributed to said rule database, to said rule inquiring and filtering module, and to said intrusion cut off system in accordance with predetermined criteria..

8. The network traffic flow control system as set forth in claim 6, wherein said packet cut off rules are distributed to said rule database, to said rule inquiring and filtering module, and to said intrusion cut off system in accordance with predetermined criteria..

9. The network traffic flow control system as set forth in claim 8, wherein said cut off rules generated by the results of detecting by said intrusion detecting system are transmitted immediately to said rule database, to said rule inquiring and filtering module, and to said intrusion cut off system, so that the corresponding data are updated.

10. A network traffic flow control system which is installed between two or more networks based on broadcasting through the switching device is characterized by being connected to one or more intrusion detecting systems that monitor flow of the packets in accordance with predetermined rules, and by performing multiple mirroring to said one or more intrusion detecting systems through a plurality of network interfaces.

11. The network traffic flow control system as set forth in claim 10, further comprising:

a mirroring interface which mirrors selectively packets received from said switching device to said intrusion detecting system in accordance with predetermined rules,

and the network traffic flow control system is characterized by transmitting the packets to the corresponding real network if a counterfeited packet has been received from said intrusion detecting system through said mirroring interface.

12. The network traffic flow control system as set forth in claim 10 or claim 11, further comprising:

a rule inquiring and filtering module which stores the rules for determining whether or not to cut off the received packets,

and the network traffic control system is characterized by cutting off the real session after transmitting counterfeited packets including a cut off message for a session to be cut off and packets including a FIN(finish) or a RST(reset).