Patent ID: 9210127
Filing Date: 2015-12-08
Classification: H04L

Abstract:
1. A system for applying a security policy to connections between a first computer on a first network and a second computer on a second network, comprising: a buffer, wherein the buffer is sized to receive and buffer data associated with a connection request; a receiver coupled to the buffer; and a connection state engine connected to the buffer; wherein the connection state engine is configured to receive an indication of the connection request from the first computer for a connection to the second computer and record initial state information and option parameters associated with the connection request; wherein the connection state engine is configured to record current connection state information associated with the connection request after the connection state engine receives an indication that the second computer has sent an acknowledgement to the first computer; wherein the receiver is configured to receive data into the buffer from one of the first or second computers after the acknowledgement, wherein the connection state engine is configured to read the received data from the buffer and is configured to deny use of the connection based on a pre-agent check that applies a security policy to the received data without forwarding the received data, responsive to receiving the indication that the second computer has sent an acknowledgement to the first computer, and wherein the security policy is expressed as a hierarchical set of rules, including rules based on reputation information assigned dynamically to a sender of the received data.