Abstract:
A system and method for protecting data of network users are provided. A user end device is connected to a routing device. Then, the routing device directs data packets of the user end device into a data protection device connected to the routing device in series, according to profiles corresponding to the user end device. Security services are performed on the received data packets by the data protection device, thereby providing effective data security protection services to network users and overcoming the drawbacks of high costs and high maintenance required for self-configuration of such mechanisms in prior techniques.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention relates to systems and methods for protecting data of network users, and more particularly, to a system and method for directing data packets of the network users into specific routing paths to implement various data security services. 
       BACKGROUND OF THE INVENTION 
       [0002]    Network systems have been constructed in increasingly faster speed with the development of network technologies. With the omnipresence of networks, users tend to conduct daily activities through networks, such as using network to search for data, purchase merchandise or even make friends. 
         [0003]    For the Internet, users normally connect online through an Internet Service Provider (ISP). ISPs are companies or organizations that provide Internet access and network information services to users by renting lines and large bandwidths and distribute them down to ordinary users with charges. Usually, users connect to the Internet through leased lines or dial-up offered by the ISP. 
         [0004]    Nowadays, viruses and malicious programs are spreading all over the Internet, causing computer break down and data lost/leak. Current approach for data protection is that the users have to buy and install firewall software/hardware themselves or install security equipments within the internal network to block viruses and malicious programs. However, the types of malicious programs are constantly evolving, so network users have to update or install new security equipments from time to time, increasing the burden for implementing and maintaining security measures. Such an approach is not effective for stopping viruses and hacker attacks. Even if a malicious packet is blocked successfully, one cannot prevent bandwidth reduction due to large amount of malicious packets. 
         [0005]    Therefore, there is a need for a system and method for protecting data of network users that effectively solves the above addressed shortcomings. 
       SUMMARY OF THE INVENTION 
       [0006]    In the light of foregoing drawbacks, the present invention provides a data protection method and system for network users to stop malicious packets or programs attacking user end devices, thereby improving level of data security of the user ends. 
         [0007]    Further, the present invention provides a data protection method and system for network users that effectively reduces cost of configuring and maintaining data security mechanisms and enhances the efficiency of network bandwidths usage. 
         [0008]    In accordance with the above and other objectives, the present invention provides a data protection system and method for network users. The data protection system for network users according to the present invention comprises: a user end device; a routing device connected to the user end device and configured to direct data packets of the user end device into a specific routing path based on a profile corresponding to the user end device; and a data protection device connected to the routing device in series and configured to receive the data packets via the specific routing path and perform a security service on the data packets. 
         [0009]    The present invention further provides a data protection system for network users, comprising: a user end device; a routing device connected to the user end device and configured to mirror data packets of the user end device based on a profile corresponding to the user end device and direct the data packets mirrored into a specific routing path; and a data protection device connected to the routing device and configured to receive the data packets mirrored via the specific routing path and perform a security service on the data packets mirrored. 
         [0010]    The present invention further provides a data protection system for network users, comprising: a user end device; a routing device connected to the user end device and configured to direct data packets of the user end device into a specific routing path based on a profile corresponding to the user end device; and a proxy server device connected to the routing device for receiving and transmitting the data packets on behalf of the user end device, wherein the proxy server device receives the data packets via the specific routing path so as to perform a security service on the data packets received. 
         [0011]    The data protection method for network users according to the present invention comprises the following steps: (1) allowing a user end device to connect with a routing device; (2) allowing the routing device to direct data packets of the user end device into a data protection device connected to the routing device in series based on a profile corresponding to the user end device; and (3) allowing the data protection device to perform a security service on the data packets received. 
         [0012]    The present invention further provides a data protection method for network users, comprising the following steps: (1) allowing a user end device to connect with a routing device; (2) allowing the routing device to mirror data packets of the user end device according to a profile corresponding to the user end device and direct the data packets mirrored into a data protection device connected to the routing device; and (3) allowing the data protection device to perform a security service on the data packets mirrored. 
         [0013]    The present invention further provides a data protection method for network users, comprising the following steps: (1) allowing a user end device to connect with a routing device; (2) allowing the routing device to connect with a proxy server device and transmit data packets of the user end device through the proxy server device; and (3) allowing the proxy server device to perform a security service on the data packets received. 
         [0014]    Compared to the prior art, the data protection system and method for network users according to the present invention exploits profiles of the user end devices to determine the transmission routing paths of the data packets, and directs the data packets into the data protection device for data security process. As a result, network viruses and hacker attacks can be successfully blocked at the ISP side, while network bandwidth can be efficiently utilized. Moreover, users do not need to self-configure data security apparatuses, thereby reducing associated costs. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0015]    The present invention can be more fully understood by reading the following detailed description of the preferred embodiments, with reference made to the accompanying drawings, wherein: 
           [0016]      FIG. 1  is a block diagram depicting a data protection system for network users according to the present invention; 
           [0017]      FIG. 2  is a block diagram depicting another data protection system for network users according to the present invention; 
           [0018]      FIG. 3  is a block diagram depicting yet another data security system for network users according to the present invention; 
           [0019]      FIG. 4  is a block diagram depicting an actual implementation of the data protection system for network users according to the present invention; 
           [0020]      FIG. 5  is a block diagram depicting another actual implementation of the data protection system for network users according to the present invention; 
           [0021]      FIG. 6  is a block diagram depicting yet another actual implementation of the data protection system for network users according to the present invention; 
           [0022]      FIG. 7  is a flowchart illustrating a data protection method for network users according to the present invention; 
           [0023]      FIG. 8  is a flowchart illustrating another data protection method for network users according to the present invention; 
           [0024]      FIG. 9  is a flowchart illustrating yet another data protection method for network users according to the present invention; and 
           [0025]      FIG. 10  is a flowchart illustrating an actual implementation of the data protection method for network users according to the present invention. 
       
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
       [0026]    The present invention is described by the following specific embodiments. Those with ordinary skills in the arts can readily understand the other advantages and functions of the present invention after reading the disclosure of the specification. The present invention can also be implemented with different embodiments. Various details described in the specification can be modified based on different viewpoints and applications without departing from the scope of the present invention. 
         [0027]    Referring to  FIG. 1 , a block diagram depicting a data protection system for network users according to the present invention is shown. The data protection system includes a user end device  10 , a routing device  11 , a data protection device  12  and the Internet  13 . 
         [0028]    The user end device  10  can be an electronic apparatus capable of accessing and processing data, such as a desktop computer, a laptop computer, a digital TV, a PDA and/or a mobile phone. 
         [0029]    The routing device  11  is used to provide connection routing paths for the user end device  10 . For data to be transmitted over the Internet  13 , the routing device  11  determines the paths for transmitting them. Since the data are divided into multiple packets, where the packets should point to is determined by the routing device  10 . Thus, when the user end device  10  uploads or receives data packets, the routing device  11  directs the data packets to specific routers or servers. 
         [0030]    The protecting device  12  is used to protect safety of the packets coming from the routing device  11 . In order to avoid the user end device  10  from receiving or transmitting abnormal packets, the data protection device  12  performs various kinds of data security measures on the packets. The contents of data security measures may include virus scanning and cleaning, blocking malicious packets and/or malicious connections. 
         [0031]    In implementation of the present invention, the user end device  10  is first connected to the routing device  11 . Then, the routing device  11  generates routing paths based on a profile corresponding to the user end device  10 . After the user end device  10  uploads a packet, the routing device  11  directs the packet into a specific routing path using a policy-based routing (PBR) technique, so as for the packet to be transmitted to the data protection device  12  for implementing data security measures. The profile is established at the time when the user end applied for an Internet connection or service, and written according to the PBR technique. It should be noted that the routing device  11  and the profile are not limited to the PBR technique, but can use any communication protocol that identifies user end request and directs that request to a specific routing path. Moreover, the data protection device  12  is connected to another platform through the Internet  13  to implement security measures. 
         [0032]    In a preferred embodiment, the user end device  10  is connected to the routing device  11  through a Wide Area Network (WAN), a Virtual Private Network (VPN), a Local Area Network (LAN) and/or wireless network. 
         [0033]    In another preferred embodiment, the routing device  11  further includes a plurality of access routers for transmitting data packets using the Generic Routing Encapsulation tunneling technique. 
         [0034]    In yet another preferred embodiment, the routing device  11  forms a plurality of virtual routers based on different profiles, thus providing a plurality of routing paths for packet transmission. 
         [0035]    Referring to  FIG. 2 , a block diagram depicting another data protection system for network users according to the present invention is shown. The data protection system shown in  FIG. 2  includes a user end device  20 , a routing device  21 , a data protection device  22  and the Internet  23 . The operations are described below. 
         [0036]    The user end device  20  has already applied to an ISP for a data security feature. The user end device  20  is then able to receive/transmit data packets from/to the Internet  23  through the routing device  21  provided by the ISP. The routing device  21  can mirror the data packets of the user end device to the data protection device  22 , and the data protection device  22  may implement the data security feature on the data packets. If the data protection device  22  finds that the webpage to which the user linked has inappropriate contents or the webpage is a malicious webpage, it signals the user end device  20  to stop the linking action, thus improving the security when user is using the Internet. 
         [0037]    In a preferred embodiment, the data protection device  22  can connect to other platform through the Internet  23  to implement security measures. 
         [0038]    Referring to  FIG. 3 , a block diagram depicting yet another data protection system for network users according to the present invention is shown. The data protection system shown in  FIG. 3  includes a user end device  30 , a routing device  31 , a proxy server device  32  and the Internet  33 . The operations are described below. 
         [0039]    Compared to the data protection system shown in  FIG. 2 , the data protection system shown in  FIG. 3  exploits the proxy server device  32  to provide data security services. The proxy server device  32  is connected to the routing device  31  and the Internet  33  for receiving/transmitting data packets on behalf of the user end device  30 . For users who did not apply for the data security service, their data packets are transmitted to the Internet through the routing device  31 . While for users who have applied for the data security service, the packets transmitted between the user end device  30  and the Internet  33  must go through the proxy server device  32 . Thus, the present invention uses the proxy server device  32  to implement various data security measures on data packets, preventing any malicious packets or virus invasion from the user end device  30 . 
         [0040]    Referring to  FIG. 4 , a block diagram depicting an actual implementation of the data protection system for network users according to the present invention is shown. In actual implementation, an ordinary user end device  40   b  connects to an access router  41  through a network connection apparatus  43   b . The access router  41  is divided into a virtual router A  410  and a virtual router B  411 . Since the ordinary user end device  40   b  only applies for a network connection service, so when a data packet enters into the access router  41 , the virtual router B  411  directs the packet to the Internet  45 . Similarly, data packets transmitted from the Internet  45  to the ordinary user end device  40   b  are transmitted to the ordinary user end device  40   b  through the access router  41 , in particular, the virtual router B  411 . 
         [0041]    For security service user end device  40   a , when it connects to the access router  41  through a network connection apparatus  43   a , the virtual router  410  will direct the packet coming from the security service user end device  40   a  to a data protection device  44 , where data packet is processed before being transmitted to the virtual router  411 , which in turn directs the packet to the Internet  45 . On the other hand, the data packets coming from the Internet  45  to the security service user end device  40   a  are transmitted through the same path, after being processed by the data protection device  44 , they are directed to the virtual router  410 , and then from there to the user end device  40   a.    
         [0042]    In a preferred embodiment, a setup server  42  provides profiles of the corresponding security service user end devices  40   a  to the access router  41 , and then the virtual router A  410  directs data packets from the security service user end device  40   a  to the data protection device  44 . 
         [0043]    Referring to  FIG. 5 , a block diagram depicting another actual implementation of the data protection system for network users according to the present invention is shown. Compared to the routing device illustrated in  FIGS. 1 to 3 , the data protection system shown in  FIG. 5  is implemented particularly through an access router  51   a  and a remote router  51   b.    
         [0044]    In actual implementation, since the local access router  51   a  is not directly connected to a security server  52 , so the access router  51   a  can connect to the remote router  51   b  through the GRE tunneling technique. When a user end device  50  wishes to transmit data packets, the access router  51   a  is responsible for directing the packets to an invasion prevention server  52  connected to the remote router  51   b . The advantage of this is that when the ISP end does not have security apparatus in a certain region, it may use data transmission technique (e.g. the GRE tunneling technique) to send the packets to the remote router  51   b  having the invasion preventing server  52  for process, reducing the investment of the ISP required for implementing data security apparatuses. Moreover, the present embodiment further provides a webpage protection apparatus  53  for analyzing and controlling the network behavior of users. For example, when the access router  51   a  detects that the user end device  50  wishes to connect to a webpage, it mirrors (backs up) a copy of the data packets to the webpage protection apparatus  53  for analysis through the router  51   a . If the webpage is found to be inappropriate or malicious, then it notifies the user end device  53  to stop linking to that webpage. The embodiment combines two security features, reducing the workload of the invasion protection server  52 . 
         [0045]    Referring to  FIG. 6 , a block diagram depicting yet another actual implementation of the data protection system for network users according to the present invention is shown. In actual implementations, an access router  61   a  connects to a remote router  61   b  via the GRE tunneling technique. When a user end device  60  transmits a data packet to the access router  61   a , the access router  61   a  directs the packet to an invasion protection server  62  connected to the remote router  61   b  for implementing security measures. The, the packet is sent back to the access router  61   a . If the user did not apply for the security service of the proxy server  63 , then the access router  61   a  transmits that packet to the Internet  64 . On the other hand, if the user applied the security service of the proxy server  63 , then the packet needs to be transmitted to the proxy server  63  before sending to the Internet  64 . 
         [0046]    In a preferred embodiment, the proxy server provides security services such as virus scanning, cleaning, malicious packet/connection blocking, invasion denial, invasion detection, content screening, webpage threat protection and/or virus protection. 
         [0047]    Referring to  FIG. 7 , which is a flowchart illustrating a data protection method for network users according to the present invention, the steps of implementing the method are described below. 
         [0048]    In step S 70 , allow a user end device to connect to a routing device. The user end device may be connected to the routing device through a WAN, a VPN, a LAN and/or wireless network. The user end device may be a desktop computer, a laptop computer, a PDA and/or a mobile phone. Then, proceed to step S 71 . 
         [0049]    In step S 71 , allow the routing device to direct data packets of the user end device to a data protection device based on a profile of the corresponding user end device. Then, proceed to step S 72 . 
         [0050]    In step S 72 , allow the data protection device to perform a data security service on the data packets. 
         [0051]    The above data protection method for network users may, in other preferred embodiment, further includes the following steps. 
         [0052]    First, the data packet of the corresponding user end device is mirrored to the data protection device by the routing device. Then, a data security service is performed on the data packet by the data protection device. 
         [0053]    The above data protection method for network users may, in other preferred embodiment, further include the following steps. 
         [0054]    First, packet transmission is performed by a proxy server device, and then a security service is performed on the data packet by the proxy server device. 
         [0055]    Referring to  FIG. 8 , which is a flowchart illustrating another data protection method for network users according to the present invention, the steps of implementing the method are described below. 
         [0056]    In step S 80 , allow a user end device to connect to a routing device. Then, proceed to step S 81 . 
         [0057]    In step S 81 , allow the routing device to mirror data packets of the user end device to a data protection device. Then, proceed to step S 82 . 
         [0058]    In step S 82 , allow the data protection device to perform a data security service on the data packets. 
         [0059]    Referring to  FIG. 9 , which is a flowchart illustrating yet another data protection method for network users according to the present invention, the steps of implementing the method are described below. 
         [0060]    In step S 90 , allow a user end device to connect to a routing device. Then, proceed to step S 91 . 
         [0061]    In step S 91 , allow the routing device to connect to a proxy server device, and allowing the proxy server device to perform data packet transmission. Then, proceed to step S 92 . 
         [0062]    In step S 92 , allow the proxy server device to perform a data security service on the data packets. 
         [0063]    Referring to  FIG. 10 , which is a flowchart illustrating an actual implementation of the data protection method for network users according to the present invention, the steps of implementing the method are described below. 
         [0064]    In step S 100 , allow an access router to direct data packets of a user end device to a specific virtual router. Then, proceed to step S 101 . 
         [0065]    In step S 101 , allow the virtual router to transmit the data packets to an invasion protection server of a remote router through a GRE tunnel. Then, proceed to step S 102 . 
         [0066]    In step S 102 , allow the invasion protection server to provide a security service to the data packets. Then, proceed to step S 103 . 
         [0067]    In step S 103 , allow the remote router to transmit the packets back to the access router through the GRE tunnel. Then, proceed to step S 104 . 
         [0068]    In step S 104 , allow the access router to mirror the data packets to a webpage protection apparatus. Then, proceed to step S 105 . 
         [0069]    In step S 105 , allow the webpage protection apparatus to perform a security service. If an abnormal packet is found, then it notifies the user end device to stop linking to the webpage. 
         [0070]    It can be observed from the above that the present invention generates and defines different routing paths based on different network users&#39; application contents. Different data security services can be provided in different routing paths, so that a more flexible data security service can be provided. Meanwhile, users save the trouble and cost for installing security apparatus themselves. 
         [0071]    Therefore, the data protection method and system for network users utilizes profiles of the network users to setup the routing path of the access routers. The routing path points towards the data protection device, thereby preventing malicious packets from entering into user devices and from spreading upwards across the Internet. 
         [0072]    In summary, the data protection method and system for network users according to the present invention has the following features: 
         [0073]    (1) improving data packet management by avoiding simultaneously receiving and processing a large amount of packets which would reduce server performance. The access router branches and controls data streams and provides different services based on user profiles, thereby eliminating workload of the server becoming too large. 
         [0074]    (2) increasing efficiency of outbound network bandwidths. By blocking malicious packets trying to enter the user&#39;s routing path at the security apparatus of the ISP, the efficiency of the outbound network bandwidths may thus increase. 
         [0075]    (3) reducing cost for installing data protection mechanisms. Since the ISP can perform data security measures for the users, the users no longer need to install data protection apparatuses themselves (e.g. firewall or antivirus software). 
         [0076]    The above embodiments are only used to illustrate the principles of the present invention, and they should not be construed as to limit the present invention in any way. The above embodiments can be modified by those with ordinary skills in the arts without departing from the scope of the present invention as defined in the following appended claims.