Source: http://www.google.com/patents/US20030182580?dq=%22peter+l+basel%22+%22lsi+logic%22
Timestamp: 2016-09-30 22:32:46
Document Index: 478246540

Matched Legal Cases: ['art 111', 'art 112', 'art 111', 'art 112', 'art 111', 'art 121', 'art 122', 'art 123', 'art 121', 'art 121', 'art 122', 'art 121', 'art 123']

Patent US20030182580 - Network traffic flow control system - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inPatentsThe present invention relates to a network traffic flow control system, more specifically to a system which separates networks physically and controls the flow of packets moving on the computer networks at the data link level without changing the constitution and environment of current network....http://www.google.com/patents/US20030182580?utm_source=gb-gplus-sharePatent US20030182580 - Network traffic flow control systemAdvanced Patent SearchTry the new Google Patents, with machine-classified Google Scholar results, and Japanese and South Korean patents.Publication numberUS20030182580 A1Publication typeApplicationApplication numberUS 10/362,498PCT numberPCT/KR2002/000599Publication dateSep 25, 2003Filing dateApr 4, 2002Priority dateMay 4, 2001Also published asWO2002091674A1Publication number10362498, 362498, PCT/2002/599, PCT/KR/2/000599, PCT/KR/2/00599, PCT/KR/2002/000599, PCT/KR/2002/00599, PCT/KR2/000599, PCT/KR2/00599, PCT/KR2000599, PCT/KR2002/000599, PCT/KR2002/00599, PCT/KR2002000599, PCT/KR200200599, PCT/KR200599, US 2003/0182580 A1, US 2003/182580 A1, US 20030182580 A1, US 20030182580A1, US 2003182580 A1, US 2003182580A1, US-A1-20030182580, US-A1-2003182580, US2003/0182580A1, US2003/182580A1, US20030182580 A1, US20030182580A1, US2003182580 A1, US2003182580A1InventorsJai-hyoung LeeOriginal AssigneeLee Jai-HyoungExport CitationBiBTeX, EndNote, RefManPatent Citations (5), Referenced by (64), Classifications (31) External Links: USPTO, USPTO Assignment, EspacenetNetwork traffic flow control system
PREFERRED EMBODIMENTS OF THE INVENTION [0041] The preferred embodiments of the present invention are described below in detail, with reference to the drawings. [0042] [0042]FIG. 1 is a block diagram showing an internal constitution of the network traffic flow control system in accordance with an embodiment of the present invention. As shown in FIG. 1, the above system 100 according to an embodiment of the present invention consists of an internal interface 110, a mirroring interface 120, a rule inquiring and filtering module 130, an NAT 140, an external interface 150, and a communication/administration interface 160. [0043] The above internal interface 110 transmits/receives packets from the internal network 10 to the external network 20 while connected to the internal network 10, the mirroring interface 120, and the rule inquiring and filtering module 130, and the above external interface 150 transmits/receives packets from the external network 20 to the internal network 10 while connected to the mirroring interface 120, the NAT 140, and the external network 20. A more detailed constitution of the above internal interface 110 and external interface 150 is shown in FIG. 2. [0044] [0044]FIG. 2 is a block diagram showing a detailed constitution of the internal interface 110 and the external interface 150. As shown in FIG. 2, the internal/external interface 110, 150 is connected to the mirroring interface 120, the rule inquiring and filtering module 130, and the internal network 10 or the external network 20 while comprising inside thereof a receiving buffer part 111, a transmission buffer part 112, and a flow control rule database 113. The internal/external interface 110, 150 operates as follows. [0045] First, if a packet is received from the internal/external network 10, 20, the packet is stored in the receiving buffer part 111, and then, it is determined with reference to the flow control rule database 113 whether the packet shall be mirrored. If the packet is determined to be one to be mirrored, then, the packet is transmitted to the mirroring interface 120 as well as to the rule inquiring and filtering module 130 or the NAT 140, after the packet has been re-scheduled. [0046] If the packet is received from the rule inquiring and filtering module 130 or the NAT 140 as described above, the packet is stored in the transmission buffer part 112. And then, it is determined, with reference to the flow control rule database 112, whether the packet shall be mirrored. If the packet is determined to be one to be mirrored, then, the packet is transmitted to the mirroring interface 120 as well as to the internal/external network 10, 20, after the packet has been re-scheduled. [0047] Here, it is confirmed, upon receiving the packet, whether a fragmentation has occurred. If a fragmentation has occurred, the packet is transformed into a whole normal packet through an IP reassemble process. For transmission of a packet, it is checked whether the packet to be transmitted is too large for the MTU size of the network interface. In a case that the packet is too large, the packet is IP fragmented, and then transmitted, which procedure is required for confirming the intrusion cut off rules or the intrusion detecting rules. [0048] Furthermore, the capacity of the above receiving buffer part 111 as well as of the transmission buffer part shall be sufficiently large so that a packet loss due to the network congestion can be prevented. [0049] Now, a description of the mirroring interface 120 of FIG. 1 is given below. The mirroring interface performs mirroring of the whole or partial traffic flow in the port to ensure that only the necessary packets are transmitted from the internal interface 110 to the intrusion detecting system 30, while connected to the internal interface 110 and the intrusion detecting system 30. A detailed constitution of the mirroring interface 120 is shown in FIG. 3. As shown in FIG. 3, the mirroring interface 120 comprises a shared memory part 121, a transmission packet administration part 122, a receiving packet administration part 123, and a network interface 124. The mirroring interface having the above constitution operates as follows. [0050] The above shared memory part 121, while connected to the internal interface 110 and the external interface 150, stores temporarily the packets received from these two interfaces. The above shared memory part 121 is additionally connected to the transmission packet administration part 122, which fetches the packets stored in the shared memory part 121 and transmits the same to the network interface 124, whereupon the network interface 124 transmits the received packets to the intrusion detecting system 30. In a case that a counterfeited packet for cut off of a TCP session is received, the receiving administration part 123 transmits the received packet to the rule inquiring and filtering module 130. [0051] As next, a description on the rule inquiring and filtering module 130 of FIG. 1 is given below. As shown in FIG. 1, the rule inquiring and filtering module 130 redirects traffic to the intrusion cut off system in accordance with the predetermined intrusion cut off rules and intrusion detecting rules, while it is connected to the internal interface 110, the NAT 140, the communication/administration interface 160, and the intrusion cut off system 40. The rule inquiring and filtering module 130 fetches to store the cut off rules from the rule database stored in the communication/administration interface 160. Although the cut off rule to be stored in the rule inquiring and filtering module 130 may comprise all cut off rules used by the intrusion cut off system, only those cut off rules of the first layer through the fourth layer of the OSI hierarchy model shall preferably be stored in order to scatter the loads on the intrusion cut off system. [0052] However, in a case that application of cut off rules of the fifth layer through the seventh layer is required, or authentication of a user or encoding is required, the packet can separately be filtered and transmitted to the intrusion cut off system 40. The above procedure enables inquiries of the cut off rule within only a short time, since the first layer through the fourth layer of the OSI hierarchy model are mere analyses of packets formed by standardized formats of the network. In addition, since many cut off rules exist normally for the cut off policy of IP and the port, the packets actually transmitted to the intrusion cut off system 40 shall be greatly reduced in comparison to the whole packets. [0053] Thus, although a system with a small capacity can be connected with the intrusion cut off system, the whole system performs without a hitch. Upon receiving the packet from the rule inquiring and filtering module 130, the intrusion cut off system 40 determines whether or not to cut off an intrusion through the intrusion cut off rules, takes other steps necessary for the security, and transmits the packet to the network interface using a default route table of its own, whereby the system 100 in accordance with the present invention receives this packet, because there is only one path out for the packet. Upon receiving the packet from the intrusion cut off system 40, the rule inquiring and filtering module 130 transmits the packet to the internal interface 110 or to the NAT 140 after having confirmed the MAC address. [0054] Now, a description of the NAT in FIG. 1 is given below. The NAT converts the address system of the internal network 10 into the address system of the external network 20, and vice versa, while connected to the above rule inquiring and filtering module 130 and the external interface 150. The NAT is one of major functions of the intrusion cut off system and harmonizes the address systems in a case that the IP address system of the internal network differs from that of the external network, and is mainly used when the IP address system of the internal network is an unauthorized IP address system. The packet is transmitted/received directly among the external interface 150, the rule inquiring and filtering module 130. [0055] However, without an NAT 140, scattering of loads on the intrusion cut off system utilizing the function of NAT is not possible. In other words, all packets are transmitted to the linked intrusion cut off system in a case that NAT is not existent. If the NAT 140 is used, both the transmission IP address and the destination IP address of the packet are changed into authorized IP addresses. And then, the packet is corrected and transmitted to the external interface 150. In a case that the internal network is set to an unauthorized IP address, address of all packets is changed by the NAT 140. [0056] Next, the communication/administration interface 160 in FIG. 1 is explained below with reference to FIG. 4. The above communication/administration interface 160, being an interface to allow a system administrator to set up rules, to control the system, to administer the system, e.g. by inquiring a statistical information, etc., and to exchange, if necessary, the log statistics with the security system, is connected to the intrusion cut off system 40, the rule inquiring and filtering module 130, and the clients as shown in FIG. 4, and comprises in inside thereof a first communication module 161, a second communication module 162, a rule database 163, a statistics database 164, and a log database 165. [0057] The above client being an administrator accessing the system 100 via a computer and the like, can manipulate through the first communication module 161 various rules in the rule database 163, by registering, correcting, deleting, etc. the same. In addition, the intrusion cut off system 40 provides also an application program interface (“hereinafter, API”) to allow sharing of the rules via the second and the first communication modules 162, 161. In this API, a capacity to store the cut off/allowance rules consisted of the protocol, the client IP, the server IP, the server ports etc., an IP list of the cut off exception clients, URLs to be cut off, IP lists of the internal network and the external network, etc. Further, the clients may access the network traffic log database 165 using the first communication module 161 to inquire the log information. Likewise, information stored in the log database 165 and in the statistics database 164 can be transmitted to the intrusion cut off system 40 via the second communication module 162 as defined by the rule database 163. In such case, the intrusion cut off system 40 can add the cut off contents and the statistics performed by itself to those performed by the present system 100 and report on the results of the addition. [0058] [0058]FIG. 5, being a block diagram showing the network traffic flow control system 100 in accordance with the present invention as it is connected in a network, shows a case where the system 100 in accordance with the present invention functions as a bridge. As shown in FIG. 5, the network flow control system 100 in accordance with the present invention is connected between the internal network 10 and the external network 20, and a plurality of intrusion cut off system 40 or intrusion detecting system as in FIG. 1 is also connected to the above system 100. In a network based on broadcasting such as the Ethernet, a packet destined to a specific host is broadcasted to the whole subnets. [0059] Each network interface connected to the network is changed to a mode capable of fetching all packets. The network interface functions as a bridge with a switching function by confirming the MAC address among the OSI reference models of the destination in the packet, and transmitting the packet back to the corresponding network interface. Here, after analysis of the packets, the system processes the packets that it can process by itself and transmits other packets to be processed by the security system to the security system. [0060] The security system checks whether to cut off these packets or to authenticate them, and then, sets up a path back to the system 100 and transmits those packets. If the traffic flow control system 100 of the present invention transmit the packets received from the security system via the corresponding network interface after confirming the MAC address, a communication is established. [0061] In a case that the security system in FIG. 5 is an intrusion cut off system 30 in FIG. 1, the received packet is copied in accordance with predetermined rules and transmitted to the corresponding network interface after the MAC address of the packet has been confirmed. The above procedure is a flow mirroring function of the mirroring interface 120 as explained in FIG. 1 performed in respect to the whole or to a partial traffic. Here, network interface for the flow mirroring may be selected in plural in order to enable linkage to a plurality of systems. [0062] [0062]FIG. 6, being a block diagram for another connection in a network of the network traffic flow control system 100 in accordance with the present invention as described in FIGS. 1 through 4, shows the system as a packet collecting engine system without a bridge function. As shown in FIG. 6, the traffic flow control system 100 is connected to a switching device 50, while a plurality of intrusion detecting system or network monitoring system 60 is connected thereto. The system in FIG. 6, in difference to the system in FIG. 1, does not have the function to redirect the path and to transmit the packet, but rather has only the simple function of copying the packet. Here, although a linking with the intrusion cut off system is impossible, connection to a plurality of intrusion detecting systems or to network monitoring systems is possible without loading the network. [0063] However, the network interface of the switching device, which connects the switching device 50 to the traffic flow control system 100 shall be defined as a mirroring port. FIG. 7 is a flow chart showing the detailed control process of the traffic flow by the network traffic flow control system as described above. [0064] Upon receiving the packet, the system 100 confirms whether the packet contains an address resolution protocol (hereinafter, “ARP”) S100. If an ARP is contained, the MAC address of the starting location is updated at the ARP cache S110. Here, contents of the update are that the address of the corresponding data link layer belongs to how network interface. [0065] Then, it is confirmed whether the packet is an ARP request packet S120. If the packet is an ARP request packet, it is broadcasted to all network interfaces owned by the system S130. If the packet is not an ARP request packet, but rather an ARP response packet, the network interface to which the address belongs is searched at the ARP cache using the MAC address of the destination, and the packet is transmitted to the corresponding interface S140. By proceeding as above, processing of the ARP request/response packet is terminated. [0066] On the other hand, if the packet is one from a local TCP/IP stack, or one fetched from a network interface and not from an ARP packet, it is confirmed whether the IP address is a local one S200. If the destination IP address is a local one, the packet is transmitted to the TCP/IP stack S210. [0067] If the destination IP address is not a local one, the defined values of the corresponding interfaces are fetched in sequence from the flow control list of the flow control rule database and are compared 300. In the flow control list, different modes such as general mode, path setting mode, and mirroring mode are listed Since the flow control list can comprise a plurality of mirroring modes or a plurality of path setting modes, processing of a packet can be completed after all the modes listed in the flow control list for each packet have been processed. [0068] If the flow control list includes the mirroring mode at the step S300, the packet is transmitted to the corresponding network interface S400, and if not, the subsequent value on the flow control list is compared. [0069] If the flow control list includes the general mode at the step S300, which means transmission of an ordinary packet, then, it is confirmed whether the packet is an internal packet S500. If the packet is an internal packet, it is transmitted to the rule inquiring and filtering module, to determine whether or not to cut off the packet S510. If the packet is one to be cut off, the packet is cut off, while the packet is transmitted to the NAT S520, if it is one to pass through. [0070] If the address translation rule has been set up, the NAT transfers the packet to the packet transmission module and fetches the network interface from the ARP cache S530, and then, transmits the packet to the network interface after the NAT changes the source IP and the destination IP and reassembles the packet If the packet at the above step S500 is not an internal packet, the packet passes the NAT S540 to subsequently be transmitted to the rule inquiring and filtering module for determination as to whether or not to cut off S550. If the packet is one to be cut off, it is cut off, while the packet is transmitted to the corresponding network interface in a case that the packet is one to pass through S560. The reason why the sequence is changed according as whether the packet is an internal or an external packet, is that the cut off rules shall better be consistent with the network addresses for the sake of administration efficiency. If the cut off rules shall be generated in a state in which authorized IP and unauthorized IP exist in a mixture, administration of the system would be very difficult. [0071] If the path is redirected at the above step S300, it is first confirmed whether the packet is an internal packet S600. The subsequent procedures are the same as those of the general mode described above, except for the part pertaining to the packet transmission, because the network interface to which the packet is to be transmitted is already determined when the path is redirected. [0072] For reference, there are two methods for cutting off a packet i.e. by transmitting a counterfeit reset RST packet and by dropping DROP a packet. In a case that a switching type system is constituted as in FIG. 5, one among the following three methods may be opted: for transmitting a counterfeited packet consisted of a setting of a counterfeited packet containing a message saying that cut off has occurred, and a finish FIN flag; by transmitting a reset RST packet in a case that no such cut off message is contained; and by simply dropping DROP the packet A selection among these three methods is made based on the kinds of the protocol service or at disposition of the administrator. However, under a packet monitoring type network constitution as in FIG. 6, the packet dropping method cannot be adopted. [0073] Although the present invention has been described above referring to the preferred embodiments of the invention, the scope of rights of the present invention is not limited thereto, but rather shall be determined by the appended claims, allowing various adaptations and modifications, without departing the scope and spirit of the present invention as those skilled in the art will understand. [0074] Industrial Applicability [0075] As described above, the present invention provides a network traffic control system equipped with a bridge function, which allows logically separated networks to have a same address without changing the constitution and environment of the existing network, while physically separating the network. In addition, the above system can scatter the loads in connection with a plurality of systems for control of the traffic in a high-speed network equipped with a bridge function. [0076] The present invention further allows to reduce the loads on a security system by reducing the traffic through wholly or partially filtering the packets in a plurality of intrusion cut off systems, intrusion detecting systems, etc. while collecting packets in one network. [0077] The present invention can prevent development of a bottleneck in an intrusion cut off system, by preventing transmission of all packets to the intrusion cut off system using an NAT installed in it. [0078] In addition, the present invention provides the administrators with convenience in administration, by transforming the intrusion rules detected by the intrusion detecting system to intrusion policies, so that they are reflected in the intrusion rules. Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS5774660 *Aug 5, 1996Jun 30, 1998Resonate, Inc.World-wide-web server with delayed resource-binding for resource-based load balancing on a distributed resource multi-node networkUS6212635 *Jul 14, 1998Apr 3, 2001David C. ReardonNetwork security system allowing access and modification to a security subsystem after initial installation when a master token is in placeUS6230271 *Jan 20, 1998May 8, 2001Pilot Network Services, Inc.Dynamic policy-based apparatus for wide-range configurable network service authentication and access control using a fixed-path hardware configurationUS6584508 *Dec 30, 1999Jun 24, 2003Networks Associates Technology, Inc.Advanced data guard having independently wrapped componentsUS20020069356 *Feb 14, 2001Jun 6, 2002Kwang Tae KimIntegrated security gateway apparatus* Cited by examinerReferenced byCiting PatentFiling datePublication dateApplicantTitleUS6985920 *Jun 23, 2003Jan 10, 2006Protego Networks Inc.Method and system for determining intra-session event correlation across network address translation devicesUS7426512 *Feb 17, 2004Sep 16, 2008Guardium, Inc.System and methods for tracking local database accessUS7469418Oct 1, 2003Dec 23, 2008Mirage Networks, Inc.Deterring network incursionUS7483972May 21, 2003Jan 27, 2009Cisco Technology, Inc.Network security monitoring systemUS7490235Oct 8, 2004Feb 10, 2009International Business Machines CorporationOffline analysis of packetsUS7506360Oct 1, 2003Mar 17, 2009Mirage Networks, Inc.Tracking communication for determining device statesUS7515603Nov 17, 2004Apr 7, 2009Sagem Defense SecuriteOne-way connection device suitable for use in an ethernet networkUS7565690 *Jul 21, 2009At&T Intellectual Property I, L.P.Intrusion detectionUS7644365Sep 12, 2003Jan 5, 2010Cisco Technology, Inc.Method and system for displaying network security incidentsUS7769851Aug 3, 2010Juniper Networks, Inc.Application-layer monitoring and profiling network trafficUS7797411Sep 14, 2010Juniper Networks, Inc.Detection and prevention of encapsulated network attacks using an intermediate deviceUS7797419Oct 31, 2005Sep 14, 2010Protego Networks, Inc.Method of determining intra-session event correlation across network address translation devicesUS7805604Sep 28, 2010International Business Machines CorporationOffline analysis of packetsUS7809826Jan 27, 2005Oct 5, 2010Juniper Networks, Inc.Remote aggregation of network traffic profiling dataUS7810151Jan 27, 2005Oct 5, 2010Juniper Networks, Inc.Automated change detection within a network environmentUS7849506 *Oct 12, 2004Dec 7, 2010Avaya Inc.Switching device, method, and computer program for efficient intrusion detectionUS7882262Aug 18, 2005Feb 1, 2011Cisco Technology, Inc.Method and system for inline top N query computationUS7904454Jun 16, 2002Mar 8, 2011International Business Machines CorporationDatabase access securityUS7930739 *Apr 19, 2011Symantec CorporationScaled scanning parameterizationUS7933923Nov 4, 2005Apr 26, 2011International Business Machines CorporationTracking and reconciling database commandsUS7937755 *May 3, 2011Juniper Networks, Inc.Identification of network policy violationsUS7970788Aug 2, 2005Jun 28, 2011International Business Machines CorporationSelective local database access restrictionUS8141100Dec 20, 2006Mar 20, 2012International Business Machines CorporationIdentifying attribute propagation for multi-tier processingUS8166186 *Oct 13, 2005Apr 24, 2012Sony CorporationContent distribution method, program, and information processing apparatusUS8209756Jun 26, 2012Juniper Networks, Inc.Compound attack detection in a computer networkUS8233388Jul 31, 2012Cisco Technology, Inc.System and method for controlling and tracking network content flowUS8260961Sep 4, 2012Trustwave Holdings, Inc.Logical / physical address state lifecycle managementUS8261326Apr 25, 2008Sep 4, 2012International Business Machines CorporationNetwork intrusion blocking security overlayUS8266267Aug 26, 2010Sep 11, 2012Juniper Networks, Inc.Detection and prevention of encapsulated network attacks using an intermediate deviceUS8326961 *Apr 23, 2010Dec 4, 2012Juniper Networks, Inc.Intelligent integrated network security device for high-availability applicationsUS8423894Nov 16, 2009Apr 16, 2013Cisco Technology, Inc.Method and system for displaying network security incidentsUS8495367Feb 22, 2007Jul 23, 2013International Business Machines CorporationNondestructive interception of secure data in transitUS8621615 *Jun 2, 2009Dec 31, 2013Juniper Networks, Inc.Behavior-based traffic profiling based on access control informationUS8631113Sep 14, 2012Jan 14, 2014Juniper Networks, Inc.Intelligent integrated network security device for high-availability applicationsUS8769665 *Apr 30, 2010Jul 1, 2014Broadcom CorporationIP communication device as firewall between network and computer systemUS8819285Dec 31, 2003Aug 26, 2014Trustwave Holdings, Inc.System and method for managing network communicationsUS8856926May 20, 2009Oct 7, 2014Juniper Networks, Inc.Dynamic policy provisioning within network security devicesUS8955119Sep 5, 2013Feb 10, 2015Juniper Networks, Inc.Behavior-based traffic profiling based on access control informationUS8959197Dec 30, 2013Feb 17, 2015Juniper Networks, Inc.Intelligent integrated network security device for high-availability applicationsUS9055088Mar 15, 2005Jun 9, 2015International Business Machines CorporationManaging a communication session with improved session establishmentUS9088544 *Sep 11, 2014Jul 21, 2015Fortinet, Inc.Interface groups for rule-based network securityUS9369434 *Jul 14, 2014Jun 14, 2016Electronics And Telecommunications Research InstituteWhitelist-based network switchUS20040133672 *May 21, 2003Jul 8, 2004Partha BhattacharyaNetwork security monitoring systemUS20040260763 *Jun 23, 2003Dec 23, 2004Partha BhattacharyaMethod and system for determining intra-session event correlation across network address translation devicesUS20050033984 *Oct 17, 2003Feb 10, 2005Sbc Knowledge Ventures, L.P.Intrusion DetectionUS20060059154 *Jan 3, 2005Mar 16, 2006Moshe RaabDatabase access securityUS20060080733 *Oct 8, 2004Apr 13, 2006International Business Machines CorporationOffline analysis of packetsUS20060089997 *Oct 13, 2005Apr 27, 2006Sony CorporationContent distribution method, program, and information processing apparatusUS20060095587 *Oct 31, 2005May 4, 2006Partha BhattacharyaMethod of determining intra-session event correlation across network address translation devicesUS20060212587 *Mar 15, 2005Sep 21, 2006International Business Machines CorporationSystem, method and program product to manage a communication sessionUS20070195776 *Feb 23, 2006Aug 23, 2007Zheng Danyang RSystem and method for channeling network trafficUS20070234425 *Jun 15, 2006Oct 4, 2007Woonyon KimMultistep integrated security management system and method using intrusion detection log collection engine and traffic statistic generation engineUS20080196104 *Feb 11, 2008Aug 14, 2008George TuvellOff-line mms malware scanning system and methodUS20080232359 *Mar 23, 2007Sep 25, 2008Taeho KimFast packet filtering algorithmUS20090125714 *Jan 6, 2009May 14, 2009International Business Machines CorporationOffline analysis of packetsUS20090328219 *Dec 31, 2009Juniper Networks, Inc.Dynamic policy provisioning within network security devicesUS20100058165 *Mar 4, 2010Partha BhattacharyaMethod and system for displaying network security incidentsUS20100242093 *Apr 23, 2010Sep 23, 2010Juniper Networks, Inc.Intelligent integrated network security device for high-availability applicationsUS20100257580 *Jun 2, 2009Oct 7, 2010Juniper Networks, Inc.Behavior-based traffic profiling based on access control informationUS20110078782 *Apr 30, 2010Mar 31, 2011Broadcom CorporationIp communication device as firewall between network and computer systemUS20150067764 *Jul 14, 2014Mar 5, 2015Electronics And Telecommunications Research InstituteWhitelist-based network switchUS20160080321 *Jun 9, 2015Mar 17, 2016Fortinet, Inc.Interface groups for rule-based network securityEP1533947A1 *Nov 4, 2004May 25, 2005Sagem SAApparatus for unidirectinal connection in an Ethernet networkWO2006037809A1Oct 7, 2005Apr 13, 2006International Business Machines CorporationOffline analysis of packets* Cited by examinerClassifications U.S. Classification726/11International ClassificationH04L29/06, H04L12/413, H04L29/12, H04L12/24, H04L12/26, H04L12/22Cooperative ClassificationH04L63/1441, H04L29/12009, H04L63/0227, H04L63/104, H04L61/25, H04L41/00, H04L29/1233, H04L12/24, H04L63/1425, H04L47/10, H04L63/0209, H04L63/0263European ClassificationH04L63/02B6, H04L63/14D, H04L63/02B, H04L63/02A, H04L63/14A2, H04L47/10, H04L63/10C, H04L61/25, H04L41/00, H04L29/12A, H04L12/24, H04L29/12A4RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services