Patent ID: 7673049
Filing Date: 2010-03-02
Classification: H04L

Abstract:
1. A method of preventing unacceptable communications comprising: receiving, by a domain name server on a local network, an address request from a client device for a network address of a computing device on the local network; transmitting, by the domain name server, a public address for a network security system to the client device, the network security system comprising a load balancer and plurality of network security subsystems, the security subsystems each having a private network address; receiving, by the load balancer of the network security system, a communication request from the client device containing information destined for the computing device, the communication request having the public address of the network security system as its destination address; at the load balancer, translating the destination address of the communication request from the public address of the network security system to a private address of one network security subsystem of the plurality of the network security subsystems and forwarding the communication request to an intrusion detection module of the network security subsystem; at the intrusion detection module, determining whether the communication request is an intrusion attempt; if the communication request is not the intrusion attempt, translating the destination address of the communication request to the network address of the computing device on the local network and forwarding the communication request to the load balancer; at the load balancer, translating a source address of the communication request from the private address of the network security subsystem to the public address of the network security system and forwarding the communication request from the network security system to the computing device; transmitting, by the computing device, a response to the communication request; receiving the response by the load balancer at the network security system, the communication response having the public address of the network security system as its destination address; at the load balancer, translating the destination address of the communication response from the public address of the network security system to a private address of the same network security subsystem from the plurality of the network security subsystems of the network security system and forwarding the communication response to the same intrusion detection module of the network security subsystem; at the intrusion detection module, determining whether the response is an intrusion attempt, the determining being performed externally of the local network at the network security system; if the response is not an intrusion attempt, translating the destination address of the communication response to network address of the client device and forwarding the communication request to the load balancer; and at the load balancer, translating a source address of the communication response from the private address of the network security subsystem to the public address of the network security system and forwarding the response from the network security system to the client device.