Patent ID: 6141755
Filing Date: 2000-10-31
Classification: H04L

Abstract:
A firewall security apparatus for high-speed circuit switched networks deployed between an external circuit switched network and an internal circuit switched network for preventing unauthorized communications between the external and internal circuit switched networks, while permitting authorized communications, comprising:an external network transceiver having means for receiving incoming protocol data units (PDUs) from the external circuit switched network and transforming the physical line characteristics of the PDUs on the external circuit switched network media to a digital bit stream protocol data units and having means for receiving digital bit stream PDUs, transforming the received digital bit stream PDUs to the physical line characteristics of the external circuit switched network media, and transmitting the PDUs on the external circuit switched network;an internal network transceiver having means for receiving incoming PDUs from the internal circuit switched network and transforming the physical line characteristics of the PDUs on the internal circuit switched network media to a digital bit stream PDUs and having means for receiving digital bit stream PDUs, transforming the received digital bit stream PDUs to the physical line characteristics of the internal circuit switched network media, and transmitting the PDUs on the internal circuit switched network;a flow switch for switching the communications between the external and internal circuit switched networks on command, connected in series between said external network transceiver and said internal network transceiver, and having means for receiving commands, having means for receiving digital bit stream PDUs from said external network transceiver, causing the digital bit stream PDUs received from said external network transceiver to be transmitted to said internal network transceiver, and causing said internal network transceiver to transform the digital bit stream PDUs received from said external network transceiver to the physical line characteristics of the internal circuit switched network media and to transmit them on the internal circuit switch network on command and having means for receiving digital bit stream PDUs from said internal network transceiver, causing the digital bit stream PDUs received from said internal network transceiver to be transmitted to said external network transceiver, and causing said external network transceiver to transform the digital bit stream PDUs received from said internal network transceiver to the physical line characteristics of the external circuit switched network media and to transmit them on the external circuit switch network on command;a firewall database for storing a list of all approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints and a list of link level identifiers identified as containing signalling messages and control information; anda firewall controller for controlling communications between the external and internal circuit switched networks,having a set of active connection management rules for determining under what circumstances communications between the external and internal circuit switched networks are authorized;having means for receiving the digital bit stream PDUs from said external network transceiver and said internal network transceiver;having means for determining if the digital bit stream PDU received is control information, commanding said flow switch to transmit the digital bit stream PDU to the external circuit switched network for digital bit stream PDUs received from the internal circuit switched network and to the internal circuit switched network for digital bit stream PDUs received from the external circuit switched network, processing the control information to obtain routing and configuration information, and writing the routing and the configuration information to said firewall database, when the digital bit stream PDU is control information;having means for determining if the digital bit stream PDU received is part of a signaling message, reassembling the signaling message, determining if the signaling message is a connection request signaling message, determining if the signaling message is a connection deletion signaling message, commanding said flow switch to transmit the digital bit stream PDU to the external circuit switched network for digital bit stream PDUs received from the internal circuit switched network and to the internal circuit switched network for digital bit stream PDUs received from the external circuit switched network when the digital bit stream PDU is a signaling message, removing the entry from the list of all approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints in said firewall database associated with the connection deletion signaling messages when the digital bit stream is a connection deletion signaling message, and adding a link level identifier entry to the list of all approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints in said firewall database associated with the connection request signaling messages when the link level identifier is authorized under said set of active connection management rules, when the digital bit stream PDU is a connection request signaling message; andhaving means for determining if the digital bit stream PDU received is data, determining if the digital bit stream PDU is listed as approved in said firewall database, and commanding said flow switch to transmit the digital bit stream PDU to the external circuit switched network for digital bit stream PDUs received from the internal circuit switched network and to the internal circuit switched network for digital bit stream PDUs received from the external circuit switched network when the digital bit stream PDU is listed as approved in said firewall database.