METHOD AND SYSTEM FOR TRANSPARENT BRIDGING AND BI-DIRECTIONAL MANAGEMENT OF NETWORK DATA

• US 20070192593A1
• Filed: 12/18/2006
• Published: 08/16/2007
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Avast Software SRO (Gen Digital Inc.)
• Original Assignee: Bsecure Technologies, Inc. (Gen Digital Inc.)
• Inventors: Balasubramaniam, Gandhi, Ashley, Stephen, Boisjolie, Darren
• Granted Patent: US 7,716,472 B2
• Time in Patent Office: Days
• US Class Current: 713/162
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A network-communication method includes detecting network activity between a local area network and a wide area network, decoding the network activity, responsive to the decoding step, obtaining at least a source network address, and using the source network address to establish a transparent networking bridge between the local area network and the wide area network.

Claims

1. A network-communication method comprising:

detecting network activity between a local area network and a wide area network;

decoding the network activity;

responsive to the decoding step, obtaining at least a source network address; and

using the source network address to establish a transparent networking bridge between the local area network and the wide area network.

2. The network-communication method of claim 1, wherein the detected network activity is outbound network activity from the local area network to the wide area network.

3. The network-communication method of claim 2, wherein the obtaining step comprises obtaining a device address of a first gateway of the wide area network.

4. The network-communication method of claim 3, wherein the network address is an Internet Protocol address and the device address is a Media Access Control address.

5. The network-communication method of claim 2, wherein the detected network activity comprises a DHCP offer packet.

6. The network-communication method of claim 1, wherein the detected network activity comprises a DHCP request packet.

7. The network-communication method of claim 1, further comprising:

creating a DHCP offer packet; and

wherein the detected network activity comprises a DHCP request packet.

8. The network-communication method of claim 1, wherein the step of using the source network address comprises using a network address having a same range as the source network address.

9. The network-communication method of claim 1, further comprising communicating with an authentication server on the wide area network.

10. The network-communication method of claim 9, wherein the communicating step comprises determining whether an account has already been set up.

11. The network-communication method of claim 10, comprising:

responsive to a determination that an account has already been set up, receiving account policy information; and

responsive to a determination that an account has not been set up, creating an account.

12. The network-communication method of claim 1, comprising evaluating at least some inbound data in accordance with pre-defined criteria.

14. The network-communication method of claim 1, wherein the local area network comprises a plurality of client devices.

15. The network-communication method of claim 1, comprising:

receiving a tagged data packet;

evaluating information in the tagged data packet;

responsive to the evaluating step, implementing a security measure.

16. The network-communication method of claim 1, further comprising performing real-time contextual analysis to identify threats relative to at least one of web content, Spam, virus, and malware.

13. The network-communication method of claim 13, wherein the data includes information about a client, application, and user.

17. A data-traffic security method comprising:

receiving a transmission-control-protocol (TCP) synchronize (SYN) data packet;

wherein a tag of a TCP header of the TCP SYN data packet includes information about at least one of a client, application, connection, and user; and

evaluating the information to determine whether security measures should be undertaken.

18. The data-traffic security method of claim 17, wherein:

the TCP header comprises an options field; and

the information is included in an option of the options field.

19. The data-traffic security method of claim 18, wherein the option is an option for MD5 encryption.

20. The data-traffic security method of claim 18, wherein:

the option for MD5 encryption is a first option for MD5 encryption;

the TCP header comprises a second option for MD5 encryption; and

the evaluating step comprises verifying a checksum to determine which of the first option for MD5 encryption and the second option for MD5 encryption includes the information.

21. The data-traffic security method of claim 19, further comprising stripping the information in the option for MD5 encryption from the TCP SYN data packet.

22. The data-traffic security method of claim 20, further comprising replacing the stripped information with null information.

23. The data-traffic security method of claim 17, further comprising sending the TCP SYN data packet toward its destination.

24. The data-traffic security method of claim 21, further comprising sending the TCP SYN data packet toward its destination.

25. The data-traffic security method of claim 22, further comprising sending the TCP SYN data packet toward its destination.

26. The data-traffic security method of claim 17, wherein the evaluating step comprises performing real-time contextual analysis to identify threats relative to at least one of web content, Spam, virus, and malware.

27. An article of manufacture for network communication, the article of manufacture comprising:

at least one computer readable medium;

processor instructions contained on the at least one computer readable medium, the processor instructions configured to be readable from the at least one computer readable medium by at least one processor and thereby cause the at least one processor to operate as to;

;

detect network activity between a local area network and a wide area network;

decode the network activity;

responsive to the decoding step, obtain at least a source network address; and

use the source network address to establish a transparent networking bridge between the local area network and the wide area network.

28. An article of manufacture for data-traffic security, the article of manufacture comprising:

at least one computer readable medium;

processor instructions contained on the at least one computer readable medium, the processor instructions configured to be readable from the at least one computer readable medium by at least one processor and thereby cause the at least one processor to operate as to;

receive a transmission-control-protocol (TCP) synchronize (SYN) data packet;

wherein a tag of a TCP header of the TCP SYN data packet includes information about at least one of a client, application, connection, and user; and

evaluate the information to determine whether security measures should be undertaken.

29. A service-delivery system comprising:

a computer layer adapted to provide local protection of data on at least one client on the computer layer;

a device layer interoperably connected to the computer layer and adapted to protect the at least one client against at least one threat;

a web service layer interoperably connected to the device layer and adapted manage network security for the at least one client; and

wherein the computer layer is adapted to communicate on at least a periodic basis with the device layer and the web services layer.

30. The service-delivery system of claim 29, wherein the device layer is implemented on a security device.

31. The service-delivery system of claim 29, wherein the device layer is implemented on a router.

32. The service-delivery system of claim 29, wherein the web services layer is adapted to provide updated information regarding at least one of emerging threats, content classifications, virus definitions, spyware definitions, phishing threats, Spam sources, and service updates.

33. The service-delivery system of claim 29, wherein the web services layer is adapted to perform realtime analysis of data received from the device layer.

34. The service-delivery system of claim 29, wherein the device layer is a hardware-based system adapted to stop internet-based threats from reaching the computer layer.

35. The service-delivery system of claim 29, wherein the device layer is adapted to filter data received from the computer layer for personal information and requests for inappropriate content.