Patent ID: 11888865
Assignee: BELDEN INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 10:
11. A system for preventing data exfiltration from a secure network, comprising:
a device associated with a first network zone comprising a processor and a network interface;
wherein the network interface is configured to receive a first internet protocol (IP) packet and receive a second IP packet;
wherein the processor is configured to:
determine that a first protocol above a network layer and a first size of the first IP packet matches a predetermined policy of a plurality of predetermined policies;
inspect a first payload of the first IP packet based on the predetermined policy to identify a first format of the first IP packet;
detect, responsive to inspecting the first payload, that the first payload includes a first set of data that violates the first format;
determine, responsive to detecting the first set of data, that the first IP packet improperly complies with the first format;
responsive to determining that the first IP packet improperly complies with the first format, truncate the first payload of the first IP packet to a size determined based on the first format, wherein truncate the first payload of the first IP packet includes removing the first set of data from the first payload;
determine that a second protocol above the network layer and a second size of the second IP packet matches the predetermined policy;
inspect a second payload of the second IP packet based on the predetermined policy to identify a second source, a second destination, and a second format of the second IP packet; and
determine that each of the second source, the second destination, and the second format is proper based on the predetermined policy; and

wherein the network interface is further configured to transmit the second IP packet responsive to the determination that the second format is proper.