CA2272056C - A method and apparatus for updating address lists for a packet filter processor - Google Patents
A method and apparatus for updating address lists for a packet filter processor Download PDFInfo
- Publication number
- CA2272056C CA2272056C CA002272056A CA2272056A CA2272056C CA 2272056 C CA2272056 C CA 2272056C CA 002272056 A CA002272056 A CA 002272056A CA 2272056 A CA2272056 A CA 2272056A CA 2272056 C CA2272056 C CA 2272056C
- Authority
- CA
- Canada
- Prior art keywords
- list
- packet
- network
- lists
- source
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
Abstract
A dedicated data packet filtering processor whose only function is to filter data packets based on a list of source IP addresses stored in high-speed memory of the processor. The processor has a specialized operating system which controls the operation of the processor. The processor examines the source IP address of each received data packet to determine if the source IP
address matches one of the stored source IP addresses, and if there is a match, either discards or forwards the data packet depending on the processor configuration. The list of source IP addresses are updated by a service provider having a central administrative site. The service provider keeps these lists up to data and periodically updates the source IP addresses stored in the random access memory of the dedicated IP filtering processors.
address matches one of the stored source IP addresses, and if there is a match, either discards or forwards the data packet depending on the processor configuration. The list of source IP addresses are updated by a service provider having a central administrative site. The service provider keeps these lists up to data and periodically updates the source IP addresses stored in the random access memory of the dedicated IP filtering processors.
Description
A METIiOD AND APPARATUS FOR UPDATINC3 ADDRESS LISTS FOR A
PACKET FILTER PROCESSOR
The invention relates to packet filters in general.
More particularly, the invention relates to a method and apparatus for filtering data packets using a dedicated processor and a list of source addresses stored in high-speed memory, as well as a means for periodically updating the list of source addresses to ensure the list is kept current.
Many companies and individual homes have access to the Internet, and more particularly, the World Wide Web (WWW). With the growing number of Internet sites, there is also a growing number of sites which provide content that some companies may deem inappropriate for the workplace. Similarly, there are many Internet sites which provide content that parents may deem inappropriate for young children.
Data packet filters are currently available which filter out data packets from certain Internet sites. On the commercial side, these filters are often implemented as part of a router or "firewall." On the individual side, these filters are implemented as programs which run on a personal computer and operate in conjunction with individual browser software. Both the commercial and individual filters operate by storing lists of prohibited source addresses, such as Internet Protocol (IP) addresses, and filtering out any data packets received from a site with a prohibited source IP
address. One problem with the currently available filters is that there is a performance degradation as the list of prohibited source IP addresses grows.
Another problem is the administration of prohibited source IP address lists. Internet sites are being added and changed every day, and it is very difficult to keep a prohibited source IP address list up to date.
One example of a conventional data packet filter is described in United States Patent Number 5,606,668 titled "System for Securing Inbound and Outbound Data Packet Flow in a Computer Network." The '668 patent relates to computer network security and the control of information flow between internal and external network destinations. The patent broadly describes prior art packet filtering using access list tables. The patent is directed to a filter module which provides network security by specifying security rules for network traffic and accepting or dropping data packets according to the security rules. The rules are implemented in packet filter code which is executed by packet filter modules located at various locations within the network.
The packet filter disclosed in the '668 patent, however, is less than satisfactory for a number of reasons. In accordance with the disclosure of the '668 patent, the packet filter modules are embodied as "virtual machines" residing on existing network host computers. Thus, these filters are software modules executing on existing network computers, and are not separate dedicated filtering processors. Further, this patent fails to describe a method for administering and updating the access list tables. In addition, the packet filter disclosed in the '668 patent is implemented between the data link layer and network layer of the International Standardization Organization (ISO) protocol stack. Therefore, the packets must unnecessarily pass through the protocols set forth for the data link layer before being filtered, which slows down the processing speed of the packet filter.
Another example-of a conventional data packet filter is shown in United States Patent Number 5,615,340 titled "Network Interfacing Apparatus and Method Using Repeater and Cascade Interface with Scrambling." The '340 patent relates to interfacing nodes in a network.
Each node is associated with a plurality of working ports. When a node receives an incoming data packet, the destination address of the data packet is compared against a stored address table to determine if the data packet is destined for a working port associated with the node. The node will only transmit the data packet to the node s working ports if there is a match.
Similarly, when a node receives an outgoing data packet, the destination address of the data packet is compared against the stored address table to determine if the data packet is destined for a working port associated with the node. If there is a match, then the node will transmit the data packet back to its working nodes.
Otherwise, the node will transmit the data packet to the network. This system is not used for filtering unwanted data packets, but is instead used for network routing of data packets. Further, as with the "668 patent, the '340 patent fails to disclose a means for updating the source address list.
From the foregoing, it can be appreciated that a substantial needs exists for a high performance data packet filter which can work with a large number of source IP addresses. There is also a need for an efficient way to adminisfier source IP address lists, SU1~1ARY OF THE INVENTION
One embodiment of the present, invention proposes a method and apparatus for updating a profile of 5 source IP address .li:>ts for pa:ket.. filtering devices.
A service provicier administers a uatabase of source IP
address lists. E:,ach list may ~~ont~~in the IP addresses of particular type: of Internet s.it.es. The service provider keeps there lists up to caate and periodically updates the source IF addresses stored in the random access memory of the dedicated IP filtering processors. In t.hi:> manner, end users can be assured that the source IP address lists stored in their filtering processor are up to datf~, 15 In accordance with one aspect of the present invention there is provided an apparatus for updating packet filtering devices, comprising: a database for storing a plurality of data packet origination address lists, with each list comprising a plurality of_ data 20 packet origination addresses: means for selecting at least one list from said plurality of data packet origination address lists for sending to at least one packet filtering devices and an output means for sending said selected list to Said at least one packet 25 filtering device via a communication network ate predetermined intervals.
In accordance with another aspect of the present invention there is provided a method for updating a packet filter processor, compx:ising the steps of:
30 storing a plurality of data packet origination address lists, with each list comprising a plurality of data packet arigination addresses; selecting at least one 4a list from said plu:ra::_ity of data ~:~acket origination address lists for transfer to at 1_east one end user device; and sending raid selected list to said at least one end user device at predet.ermi.ned intervals.
5 With these and c?ther_ advan.tac~es and features of the invention that will become her~°einafter apparent, the nature of. the invention may bf:e more clearly understood by reference t:.c> the forl.lowing detailed description of the invention, the appended claims and to the several drawings attached ruerein.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 illustrates a network topology suitable for practicing one err:bodiment of t:he invention.
FIG. 2 is a block diagram of a packet filter processor in accardarce with one ~::mbodiment of the invention.
FIG. 3 is a block flow diagram of steps for filtering data pac:~ets in accardarsce with one embodiment of the invention.
S
Referring now in detail to the drawings wherein like parts are designated by like reference numerals throughout, there is illustrated in FIG. 1 a network topology suitable for practicing one embodiment of the invention. As shown in FIG. 1, a first network 10 is connected to a router 12. Router 12 is in turn connected to a packet filter processor 14. Packet filter processor 14 is connected to a second network 16 and an end-user terminal 18.
Networks 10 and 16 are packet based networks, such as Transmission Control Protocol/Internet Protocol (TCP/IP) networks or X.2S networks. A packet originates from network 10 with an intended destination to network 16 or end-user terminal 18. Both the source and destination addresses are included in the packet.
It is worthy to note that the network topology shown in FIG. 1 is exemplary only. The possible number of network configurations is virtually limitless, the design of which is well-known in the art. The present invention may work on any network configuration utilizing packet technology for transporting voice, image or data signals.
The placement of packet filter processor 14 in a network is also variable depending on where a network designer would desire to control the in-flow or out-flow of packets between networks or network devices. In this embodiment of the invention, packet filter processor 14 is positioned at the only entry and exit point of either network 10 or 16, thereby controlling which packets enter either network. It can be appreciated, however, that packet filter processor 14 could be placed on an individual network device, such as a personal computer, thereby controlling the flow of packets only to the personal computer, or in any other strategic point within a network.
FIG. 2 is a block diagram of a packet filter processor in accordance with one embodiment of the invention. As shown in FIG. 2, Local Area Network (LAN) interface (I/F) connectors 20 and 48 are coupled to network interface cards 22 and 46, respectively.
Connector 20 and card 22 are used to interface with network 10, and to accept packets originating from network 10. Connector 48 and card 46 are used to interface with network 16 or end-user terminal 18, and to accept packets originating from network 16 or terminal 18. Connectors 20 and 48, as well as cards 22 and 46, operate in accordance with principles well-known in the art.
Further, cards 22 and 46 are designed to adhere to the Institute of Electrical and Electronics Engineers (IEEE) standard titled "Carrier Sense Multiple Access with Collision Detection (CSMA/CD) Access Method and Physical Layer Specifications, American National Standard ANSI/IEEE Standard 802.3, 1985 ("IEEE 802.3 standard"). The IEEE 802.3 standard defines a technique referred to as CSMA/CD, which is appropriate for a network having a bus/tree topology. It can be appreciated, however, that network interfaces designed to work with other medium access techniques or standards could be used for packet filter processor 14, and still fall within the scope of the invention.
Cards 22 and 44 are connected to one another, and also to First In First Out (FIFO) buffers 24 and 44, respectively. FIFO buffers 24 and 44 are used to store incoming or outgoing packets in memory until each packet can be compared and sent to networks 10 or 16.
Packet filter processor 14 also includes several types of high-speed memory. By way of example, this embodiment of the invention includes a 96 kilobyte (K) Programmable Read Only Memory (PROM) 40, a 32K Non-Volatile Random Access Memory (NVRAM) 42, and a Dynamic Random Access Memory (DRAM) bank 32. There is also a DRAM control :30 for LpRAM b<.rnk 32.
Each type of memory is used t.:o store data for packet filter processor 14. For example, PROM 40 is used to store an oyez-ating system (not shown) for packet filter processor ~4. NVRAM 42 is used to store user defined parameters ;not shown), and operating system parameters (not shown) used by the operating 10 system stored in P'.~OM 40. DRAM baruk 32 is used to store an address list 33 of sourcee IP addresses.
The heart of packet filter processor 14 is a dedicated high performance mi~~roprocessor 38. Any microprocessor capable of operating at the speeds 15 necessary to implement of: the .func::tions of the packet filter processor i:; appropriate. Eaxamples of processors suitable to practice the invention includes the INTEL family o_~ ~rocessorsr such as the Pentium, Pentium~ Pro, arid 1?entiumE~, LI microprocessors.
20 Packet fi.lt.er processor 14 also includes a connector 34 and interface 36, both of which are attached to microprocessor 38. Corunector 34 and interface 36 both <adhere to Electronic Industries Association (EIA) Standard RS-232-C titled "Interface 25 Between Data 'Terminal Equipment and Data Communication Equipment Employing Serial Binary Data Interexchange, "
October, 1969. ~'int~lly, packets filter processor 14 includes a clock 2E; and clock counter 28 to control the timing of packet filter processor 14.
30 Packet filter processor 14 o~uerates in accordance with the operating system, whi~.:h is comprised of a set of computer program instructions which are stored in PROM 40. Since a 1__st of source IP addresses can include a large number of addresses, e.g., ranging from hundreds to several thousand, the processing time required to compare a source IP ac.~dress of an incoming packet with a list of several thousand source IP
5 addresses is enormous, and signif~.cantly degrades the performance of many conventional packet filters.
According to the principles of thca present invention, however, packet filtr~r processor ~_9 combines the elements of a high-speed microprocessor, a source IP
10 address list stored z.n high-speed memory, and a dedicated proprietary operating system, to ensure that data packets can be filtered at a high-rate of speed.
The operata_ng system is ~:~esic~ned to control the operation of the microprocessor 38. More 15 particularly, tale operating systenYl is designed such that microprocessor ~8 i:> directec to look. at the source IP address of each received data packet to determine if the source IP add:res:> matches one of the stored source IP addresses, and ij there is a :match, 20 to either discard or forward the data packet depending on the processor c~~nf iguz~ation. Si nce the operating system and microprocessor 3$ are Medicated to one task, packet filter processor 14 c,an perform the filtering process very quickly and efficiently. The 25 operation of the operating system, and of packet filter processor l~~ in general, will be described in more detail with reference to fIG. 3.
Another reason packet filter processor 14 is so efficient is t=hat packet filter processor' 14 is 30 implemented between the physical layer and data link layer of the TS~~ p.rot.ocol stack. 'fhe significance of this implementation can be better appreciated in view 8a of some background information of network architectures in general.
A network architvecture define~5 protocols, message formats, and standards to wrich products must conform 5 in order to connect properly with the network.
Architectures are de~reloped by st~indards organizations, common carriers, crud computer and network vendors. Vetwork archite~;;tures use a layered approach, whereby functions are organized into groups and assigned to specific functional layers in the architecture. Network architectures define the interfaces between layers in a given network node and within the same layer in two different nodes.
OSI provides a generalized model of system interconnection. It encompasses seven layers:
application, presentation, session, transport, network, data link, and physical. A brief summary for each layer is given as follows:
1. Physical Layer - The physical layer is responsible for the transmission of bit stream across a particular physical transmission medium. It involves a connection between two machines that allows electrical signals to be exchanged between them.
2. Data Link Layer - The data link layer is responsible for providing reliable data transmission from one node to another and for shielding higher layers form any concerns about the physical transmission medium. It is concerned with the error free transmission of frames of data.
3. Network Layer - The network layer is concerned with routing data from one network node to another. It is responsible for establishing, maintaining, and terminating the network connection between two users and for transferring data along that connection.
4. Tr~n,~r~rt Layer - The transport layer is responsible for providing data transfer between two users at an agreed on level of quality.
5. Session La3rer - The session layer focuses on providing services used to organize and synchronize the dialog that takes place between users and to manage data exchange.
6. Presentation LaS~ - The presentation layer is responsible for the presentation of information in a way that is meaningful to the network users, e.a., character code translation, data conversion, 10 or data compression or expansion.
7. 8nnlication Layer - The application layer provides a means for application processes to access the system interconnection facilities in order to exchange information.
Packet filter processor 14 is implemented between the physical layer and data link layers described above, in order to increase the speed at which packets are filtered. The physical layer is responsible for data encoding and decoding. Data encoding refers to translating the bits being transmitted into the proper electrical signals to be sent across the transmission medium. Data decoding translates the electrical signals received over the transmission medium into the bit stream those signals represent. The data link layer is concerned with data encapsulation/decapsulation and media access management. These functions, however, are not necessary for identifying the source address of the packet. For example, data decapsulation is the function of recognizing the destination address, determining if it matches the receiving station's address, performing error checking, and removing control information that was added by the data encapsulation function in the sending station. Therefore, by implementing packet filter processor 14 between the physical layer and data 12.
link layer, processor 14 can maximize the speed at which it filters each pac.-.ket .
FIG. 3 illustrates a block flow diagram of steps for filtering data packets i.n accc.ardance with one 5 embodiment of the invention. The description with respect to FT(~. 3 will. assume than a packet is originating from network 10 and has an intended destination address that is within network 16. It can be appreciated, however, that the c>peration of packet filter processor 14 is identical when the packet originates from network 16 or terminal 18 and has an intended desti_nati.on address with.~..n network 10.
Packet filter processor 14 rE-.aceives a packet at step 50. Connector a"0 recez.ves tine packet and passes the packet to interface card 22 which is designed to convert the electrical impulses rE.~ceived over the physical transmission media into packets conforming to the standards set forth in IEEE 8()2.3. The packet is stored in FIFO 24.
20 Processor 38 reads t:he source=~ IP address for the packet at step 52, and compares the source IP address with list 33, wtlic:~ is stored in I>RAM bank 32, at step 54. List 33 is stored in DRAM band: 32 in order to increase the speed at which data from the list could be retrieved by processor 38, as compared to, e.g., when data is stored on some other computer readable medium such as a hard drive or floppy disk. Step 56 comprises a test to determine whei:her there is a match at step 54. If there is a match at step 54, then 30 packet filter processor .'~8 rec:ord;~~ the attempt at step 58 before passing control to step 60. If there is not a match at step 54, then control ~.5 directly passed to step 60.
1 ?.
Packet filter processor 14 determines whether the packet should be passed at stF~p 6() . The decision whether to pass the packet or not is dependent upon the mode in which processor 14 is currently 5 configured, Packet f~_1_ter_ processor 14 has a restrictive mode and a permissive mode. Restrictive mode refers to a condition where a select number of packets are to be passed, and all others blocked.
Permissive mode is wl-~ere all packets are to be passed 10 except for a select few that require blocking. Thus, in permissive mode, t:he packet is passed if the source IP address for a packet does not match an address on list 33. If there is a match, packet filter processor 14 drops the packet. In restrictive mode, the packet 15 is passed if t;he source ~P address does match an address from list 33, and is dropped otherwise.
At step 60, packet filter processor 14 determines whether the packet should be posse?d depending on whether packet filter processor 14 has been set to 20 permissive mode or restrictive mode. If packet filter processor 14 has been set to restrictive mode, and there is a match at step 56, then the packet is passed at step 62 to tine des~tinat.ion net~,~erk which in this embodiment of the .invention is network 16 or terminal 25 18. If packet filter processor 14 has been set to restrictive mode, and there is not a match at step 56, then the packet is dropped at ste~3 64. Conversely, if packet filter processor 14 has been set to permissive mode, and there is a match at step 56, then the packet 30 is dropped at step 64. If. packet filter processor 14 has been set to permissive mode, and there is not a match at step 56, then the packet is passed to the destination network at step 62. Irv this embodiment of the invention, a default condition is that no feedback is given to the system sending thF, packets for security reasons if ~~ packet i.s dropped at step 64. It can be appreciated, however, that this default 5 condition can be changed and stil_i. fall within the scope of the i.nventic>n.
In accordance with the system administration aspects of the ;~nvent~ion, a service provider administers a database of scuxce :~-P address lists.
10 Each list may cont~~irl the TP addresses of particular types of Internet ~it:.es. The service provider keeps these lists up to ~~ate and period~.cally updates list 33 stored in DRAM bar7k 32 of packet filter processor 14. In this manner, end users can be assured that the 15 source IP address .Lists stored in their filtering processor are up to date.
List 33 care be updated in at least two ways.
First, list 33 would be updated by connecting Data Terminal Equipment (f>TE~) such :~s m asynchronous 20 (ASCII) terminal (or per>onal com~juter emulating an asynchronous terminal) to RS-232 connector 34 of packet filter processor 7.4. This method would enhance security when. updating list 3:3.
Alternatively, a network canr~ection is formed 25 with a central administrative sit<: equipped with a list server 70, preferably thr.ougrE an Internet Service Provider (ISP) using a direct network connection or via RS-232 connector 34. List 33 s then updated from the central administrative site, either by a request 30 by the list server 70 of the administrative site, or on the request of packet filter processor 14. List server 70 is described in more detail with reference to FIG. 4.
13a FIG. 4 is a block diagram of a list server suitable for practicing one embodiment of the invention. List server 70 comprises a main memory module 72, a central processing unit (CPU) 74, a system control module 82, a bus adapter 76, a list replication module 78, and a user interface module 80, each of which is connected to a CPU/memory bus 84 and an Input/output (I/0) bus 86 via bus adapter 76.
Further, list server 70 contains multiple I/O
controllers 88, as well as an external memory 90, a database 92 and network interface 94, each of which is connected to I/0 bus 86 via I/O controllers 88.
The overall functioning of list server 70 is controlled by CPU 74, which operates under the control of executed computer program instructions that are stored in main memory 72 or external memory 90. Both main memory 72 and external memory 90 are machine readable storage devices. The difference between main memory 72 and external memory 90 is that CPU 74 can typically access information stored in main memory 72 faster than information stored in external memory 90.
Thus, for example, main memory 72 may be any type of machine readable storage device, such as random access memory (RAM), read only memory (ROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), electronically erasable programmable read only memory (EEPROM). External memory 90 may be any type of machine readable storage device, such as magnetic storage media (~.e., a magnetic disk), or optical storage media (i-e., a CD-ROM). Further, list server 70 may contain various combinations of machine readable storage devices through other I/O controllers, which are accessible by CPU 74, and which are capable of storing a combination of computer program instructions and data.
CPU 74 includes any processor of sufficient processing power to perform the functionality found in list server 70. Examples of CPUs suitable to practice the invention includes the INTEL family of processors, such as the Pentium~, Pentium~ Pro, and Pentium~ II
microprocessors.
Network interface 94 is used for communications between list server 70 and a communications network, such as the Public Switched Telephone Network (PSTN) or the Internet. Network interface 94 supports appropriate signaling, ringing functions and voltage levels, in accordance with techniques well known in the art.
I/O controllers 88 are used to control the flow of information between list server 70 and a number of devices or networks such as external memory 90, database 92 and network interface 94. System control module 82 includes human user system control and operation. Bus adapter 76 is used for transferring data back and forth 5 between CPU/memory bus 84 and I/O bus 86.
List replication module 78 and user interface module 80 implements the main functionality for list server 70. It is noted that modules 78 and 80 are shown as separate functional modules in FIG. 4. It can be 10 appreciated, however, that the functions performed by these modules can be further separated into more modules, combined together to form one module, or be distributed throughout the system, and still fall within the scope of the invention. Further, the functionality 15 of these modules may be implemented in hardware, software, or a combination of hardware and software, using well-known signal processing techniques.
List server 70 operates as follows. A profile is established for each packet filter processor customer subscribing to the list updating service. The profile contains a copy of list 33 for each packet filter processor. List 33 at list server 70 is updated with new source IP addresses on a periodic basis. Similarly, old or invalid source IP addresses are removed from list 33 on a periodic basis.
The updating of list 33 at list server 70 can be accomplished in two ways. First, the central administrator for list server 70 obtains new source IP
address information from various sources, such as service providers or search robots specializing in gathering source IP addresses by category, telemarketers, adult material, advertising entities, hate groups, and so forth. The central administrator for list server 70 then updates list 33 at list server 70 with the new source IP address information in a timely manner, ea., within hours of receiving the new information. Second, the user of a packet filter processor can access list server 70 via user interface module 80, and perform updates to list 33 at list server 70 directly. The user could update list server 70 in a variety of ways, such as adding, deleting or modifying the source IP addresses of list 33 stored in database 92 of list server 70.
Once list 33 at list server 70 is updated, list replication module sends updated list 33 to each packet filter processor according to the profile of each packet filter processor. The profile for each packet filter processor contains information regarding when and how often list 33 at list server 70 is to be replicated to the packet filter processor. For example, list 33 at list server 70 can be replicated to a packet filter processor on a periodic basis, such as every day at a certain time, or whenever a change to list 33 at list server 70 is performed. In addition, a user of a packet filter processor may request an update of list 33, such as when the user has modified list 33 at server 70, or in the event list 33 at the packet filter processor has become corrupted or lost.
In addition to updating existing lists for packet filter processors, list server 70 has predetermined lists of source IP addresses by category. For example, a list of source IP addresses for all Internet sites containing adult material can be pre-established, and therefore readily replicated to a packet filter processor by a user simply accessing the central administrative site and making a request. Other lists for telemarketing firms, non-business related web sites, a competitor's network devices, government web sites, and so forth, could also be pre-established and made available for a user of the packet filter processor.
Although various embodiments are specifically illustrated and described herein, it will be appreciated that modifications and variations of the present invention are covered by the above teachings and within the purview of the appended claims without departing from the spirit and intended scope of the invention.
For example, although a specific network topology has been illustrated in FIG. 1, it can be appreciated that any type of network configuration would be suitable for practicing the various embodiments of the present invention. In another example, although specific equipment was illustrated in FIG. 2 for a particular type of medium access technique, it can be appreciated that the packet filter processor shown in FIG. 2 can be modified to include equipment for any type of medium access technique, such as IEEE 802.2, 802.4, 802.5, 802.12 and so forth, and still fall within the scope of the invention.
PACKET FILTER PROCESSOR
The invention relates to packet filters in general.
More particularly, the invention relates to a method and apparatus for filtering data packets using a dedicated processor and a list of source addresses stored in high-speed memory, as well as a means for periodically updating the list of source addresses to ensure the list is kept current.
Many companies and individual homes have access to the Internet, and more particularly, the World Wide Web (WWW). With the growing number of Internet sites, there is also a growing number of sites which provide content that some companies may deem inappropriate for the workplace. Similarly, there are many Internet sites which provide content that parents may deem inappropriate for young children.
Data packet filters are currently available which filter out data packets from certain Internet sites. On the commercial side, these filters are often implemented as part of a router or "firewall." On the individual side, these filters are implemented as programs which run on a personal computer and operate in conjunction with individual browser software. Both the commercial and individual filters operate by storing lists of prohibited source addresses, such as Internet Protocol (IP) addresses, and filtering out any data packets received from a site with a prohibited source IP
address. One problem with the currently available filters is that there is a performance degradation as the list of prohibited source IP addresses grows.
Another problem is the administration of prohibited source IP address lists. Internet sites are being added and changed every day, and it is very difficult to keep a prohibited source IP address list up to date.
One example of a conventional data packet filter is described in United States Patent Number 5,606,668 titled "System for Securing Inbound and Outbound Data Packet Flow in a Computer Network." The '668 patent relates to computer network security and the control of information flow between internal and external network destinations. The patent broadly describes prior art packet filtering using access list tables. The patent is directed to a filter module which provides network security by specifying security rules for network traffic and accepting or dropping data packets according to the security rules. The rules are implemented in packet filter code which is executed by packet filter modules located at various locations within the network.
The packet filter disclosed in the '668 patent, however, is less than satisfactory for a number of reasons. In accordance with the disclosure of the '668 patent, the packet filter modules are embodied as "virtual machines" residing on existing network host computers. Thus, these filters are software modules executing on existing network computers, and are not separate dedicated filtering processors. Further, this patent fails to describe a method for administering and updating the access list tables. In addition, the packet filter disclosed in the '668 patent is implemented between the data link layer and network layer of the International Standardization Organization (ISO) protocol stack. Therefore, the packets must unnecessarily pass through the protocols set forth for the data link layer before being filtered, which slows down the processing speed of the packet filter.
Another example-of a conventional data packet filter is shown in United States Patent Number 5,615,340 titled "Network Interfacing Apparatus and Method Using Repeater and Cascade Interface with Scrambling." The '340 patent relates to interfacing nodes in a network.
Each node is associated with a plurality of working ports. When a node receives an incoming data packet, the destination address of the data packet is compared against a stored address table to determine if the data packet is destined for a working port associated with the node. The node will only transmit the data packet to the node s working ports if there is a match.
Similarly, when a node receives an outgoing data packet, the destination address of the data packet is compared against the stored address table to determine if the data packet is destined for a working port associated with the node. If there is a match, then the node will transmit the data packet back to its working nodes.
Otherwise, the node will transmit the data packet to the network. This system is not used for filtering unwanted data packets, but is instead used for network routing of data packets. Further, as with the "668 patent, the '340 patent fails to disclose a means for updating the source address list.
From the foregoing, it can be appreciated that a substantial needs exists for a high performance data packet filter which can work with a large number of source IP addresses. There is also a need for an efficient way to adminisfier source IP address lists, SU1~1ARY OF THE INVENTION
One embodiment of the present, invention proposes a method and apparatus for updating a profile of 5 source IP address .li:>ts for pa:ket.. filtering devices.
A service provicier administers a uatabase of source IP
address lists. E:,ach list may ~~ont~~in the IP addresses of particular type: of Internet s.it.es. The service provider keeps there lists up to caate and periodically updates the source IF addresses stored in the random access memory of the dedicated IP filtering processors. In t.hi:> manner, end users can be assured that the source IP address lists stored in their filtering processor are up to datf~, 15 In accordance with one aspect of the present invention there is provided an apparatus for updating packet filtering devices, comprising: a database for storing a plurality of data packet origination address lists, with each list comprising a plurality of_ data 20 packet origination addresses: means for selecting at least one list from said plurality of data packet origination address lists for sending to at least one packet filtering devices and an output means for sending said selected list to Said at least one packet 25 filtering device via a communication network ate predetermined intervals.
In accordance with another aspect of the present invention there is provided a method for updating a packet filter processor, compx:ising the steps of:
30 storing a plurality of data packet origination address lists, with each list comprising a plurality of data packet arigination addresses; selecting at least one 4a list from said plu:ra::_ity of data ~:~acket origination address lists for transfer to at 1_east one end user device; and sending raid selected list to said at least one end user device at predet.ermi.ned intervals.
5 With these and c?ther_ advan.tac~es and features of the invention that will become her~°einafter apparent, the nature of. the invention may bf:e more clearly understood by reference t:.c> the forl.lowing detailed description of the invention, the appended claims and to the several drawings attached ruerein.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 illustrates a network topology suitable for practicing one err:bodiment of t:he invention.
FIG. 2 is a block diagram of a packet filter processor in accardarce with one ~::mbodiment of the invention.
FIG. 3 is a block flow diagram of steps for filtering data pac:~ets in accardarsce with one embodiment of the invention.
S
Referring now in detail to the drawings wherein like parts are designated by like reference numerals throughout, there is illustrated in FIG. 1 a network topology suitable for practicing one embodiment of the invention. As shown in FIG. 1, a first network 10 is connected to a router 12. Router 12 is in turn connected to a packet filter processor 14. Packet filter processor 14 is connected to a second network 16 and an end-user terminal 18.
Networks 10 and 16 are packet based networks, such as Transmission Control Protocol/Internet Protocol (TCP/IP) networks or X.2S networks. A packet originates from network 10 with an intended destination to network 16 or end-user terminal 18. Both the source and destination addresses are included in the packet.
It is worthy to note that the network topology shown in FIG. 1 is exemplary only. The possible number of network configurations is virtually limitless, the design of which is well-known in the art. The present invention may work on any network configuration utilizing packet technology for transporting voice, image or data signals.
The placement of packet filter processor 14 in a network is also variable depending on where a network designer would desire to control the in-flow or out-flow of packets between networks or network devices. In this embodiment of the invention, packet filter processor 14 is positioned at the only entry and exit point of either network 10 or 16, thereby controlling which packets enter either network. It can be appreciated, however, that packet filter processor 14 could be placed on an individual network device, such as a personal computer, thereby controlling the flow of packets only to the personal computer, or in any other strategic point within a network.
FIG. 2 is a block diagram of a packet filter processor in accordance with one embodiment of the invention. As shown in FIG. 2, Local Area Network (LAN) interface (I/F) connectors 20 and 48 are coupled to network interface cards 22 and 46, respectively.
Connector 20 and card 22 are used to interface with network 10, and to accept packets originating from network 10. Connector 48 and card 46 are used to interface with network 16 or end-user terminal 18, and to accept packets originating from network 16 or terminal 18. Connectors 20 and 48, as well as cards 22 and 46, operate in accordance with principles well-known in the art.
Further, cards 22 and 46 are designed to adhere to the Institute of Electrical and Electronics Engineers (IEEE) standard titled "Carrier Sense Multiple Access with Collision Detection (CSMA/CD) Access Method and Physical Layer Specifications, American National Standard ANSI/IEEE Standard 802.3, 1985 ("IEEE 802.3 standard"). The IEEE 802.3 standard defines a technique referred to as CSMA/CD, which is appropriate for a network having a bus/tree topology. It can be appreciated, however, that network interfaces designed to work with other medium access techniques or standards could be used for packet filter processor 14, and still fall within the scope of the invention.
Cards 22 and 44 are connected to one another, and also to First In First Out (FIFO) buffers 24 and 44, respectively. FIFO buffers 24 and 44 are used to store incoming or outgoing packets in memory until each packet can be compared and sent to networks 10 or 16.
Packet filter processor 14 also includes several types of high-speed memory. By way of example, this embodiment of the invention includes a 96 kilobyte (K) Programmable Read Only Memory (PROM) 40, a 32K Non-Volatile Random Access Memory (NVRAM) 42, and a Dynamic Random Access Memory (DRAM) bank 32. There is also a DRAM control :30 for LpRAM b<.rnk 32.
Each type of memory is used t.:o store data for packet filter processor 14. For example, PROM 40 is used to store an oyez-ating system (not shown) for packet filter processor ~4. NVRAM 42 is used to store user defined parameters ;not shown), and operating system parameters (not shown) used by the operating 10 system stored in P'.~OM 40. DRAM baruk 32 is used to store an address list 33 of sourcee IP addresses.
The heart of packet filter processor 14 is a dedicated high performance mi~~roprocessor 38. Any microprocessor capable of operating at the speeds 15 necessary to implement of: the .func::tions of the packet filter processor i:; appropriate. Eaxamples of processors suitable to practice the invention includes the INTEL family o_~ ~rocessorsr such as the Pentium, Pentium~ Pro, arid 1?entiumE~, LI microprocessors.
20 Packet fi.lt.er processor 14 also includes a connector 34 and interface 36, both of which are attached to microprocessor 38. Corunector 34 and interface 36 both <adhere to Electronic Industries Association (EIA) Standard RS-232-C titled "Interface 25 Between Data 'Terminal Equipment and Data Communication Equipment Employing Serial Binary Data Interexchange, "
October, 1969. ~'int~lly, packets filter processor 14 includes a clock 2E; and clock counter 28 to control the timing of packet filter processor 14.
30 Packet filter processor 14 o~uerates in accordance with the operating system, whi~.:h is comprised of a set of computer program instructions which are stored in PROM 40. Since a 1__st of source IP addresses can include a large number of addresses, e.g., ranging from hundreds to several thousand, the processing time required to compare a source IP ac.~dress of an incoming packet with a list of several thousand source IP
5 addresses is enormous, and signif~.cantly degrades the performance of many conventional packet filters.
According to the principles of thca present invention, however, packet filtr~r processor ~_9 combines the elements of a high-speed microprocessor, a source IP
10 address list stored z.n high-speed memory, and a dedicated proprietary operating system, to ensure that data packets can be filtered at a high-rate of speed.
The operata_ng system is ~:~esic~ned to control the operation of the microprocessor 38. More 15 particularly, tale operating systenYl is designed such that microprocessor ~8 i:> directec to look. at the source IP address of each received data packet to determine if the source IP add:res:> matches one of the stored source IP addresses, and ij there is a :match, 20 to either discard or forward the data packet depending on the processor c~~nf iguz~ation. Si nce the operating system and microprocessor 3$ are Medicated to one task, packet filter processor 14 c,an perform the filtering process very quickly and efficiently. The 25 operation of the operating system, and of packet filter processor l~~ in general, will be described in more detail with reference to fIG. 3.
Another reason packet filter processor 14 is so efficient is t=hat packet filter processor' 14 is 30 implemented between the physical layer and data link layer of the TS~~ p.rot.ocol stack. 'fhe significance of this implementation can be better appreciated in view 8a of some background information of network architectures in general.
A network architvecture define~5 protocols, message formats, and standards to wrich products must conform 5 in order to connect properly with the network.
Architectures are de~reloped by st~indards organizations, common carriers, crud computer and network vendors. Vetwork archite~;;tures use a layered approach, whereby functions are organized into groups and assigned to specific functional layers in the architecture. Network architectures define the interfaces between layers in a given network node and within the same layer in two different nodes.
OSI provides a generalized model of system interconnection. It encompasses seven layers:
application, presentation, session, transport, network, data link, and physical. A brief summary for each layer is given as follows:
1. Physical Layer - The physical layer is responsible for the transmission of bit stream across a particular physical transmission medium. It involves a connection between two machines that allows electrical signals to be exchanged between them.
2. Data Link Layer - The data link layer is responsible for providing reliable data transmission from one node to another and for shielding higher layers form any concerns about the physical transmission medium. It is concerned with the error free transmission of frames of data.
3. Network Layer - The network layer is concerned with routing data from one network node to another. It is responsible for establishing, maintaining, and terminating the network connection between two users and for transferring data along that connection.
4. Tr~n,~r~rt Layer - The transport layer is responsible for providing data transfer between two users at an agreed on level of quality.
5. Session La3rer - The session layer focuses on providing services used to organize and synchronize the dialog that takes place between users and to manage data exchange.
6. Presentation LaS~ - The presentation layer is responsible for the presentation of information in a way that is meaningful to the network users, e.a., character code translation, data conversion, 10 or data compression or expansion.
7. 8nnlication Layer - The application layer provides a means for application processes to access the system interconnection facilities in order to exchange information.
Packet filter processor 14 is implemented between the physical layer and data link layers described above, in order to increase the speed at which packets are filtered. The physical layer is responsible for data encoding and decoding. Data encoding refers to translating the bits being transmitted into the proper electrical signals to be sent across the transmission medium. Data decoding translates the electrical signals received over the transmission medium into the bit stream those signals represent. The data link layer is concerned with data encapsulation/decapsulation and media access management. These functions, however, are not necessary for identifying the source address of the packet. For example, data decapsulation is the function of recognizing the destination address, determining if it matches the receiving station's address, performing error checking, and removing control information that was added by the data encapsulation function in the sending station. Therefore, by implementing packet filter processor 14 between the physical layer and data 12.
link layer, processor 14 can maximize the speed at which it filters each pac.-.ket .
FIG. 3 illustrates a block flow diagram of steps for filtering data packets i.n accc.ardance with one 5 embodiment of the invention. The description with respect to FT(~. 3 will. assume than a packet is originating from network 10 and has an intended destination address that is within network 16. It can be appreciated, however, that the c>peration of packet filter processor 14 is identical when the packet originates from network 16 or terminal 18 and has an intended desti_nati.on address with.~..n network 10.
Packet filter processor 14 rE-.aceives a packet at step 50. Connector a"0 recez.ves tine packet and passes the packet to interface card 22 which is designed to convert the electrical impulses rE.~ceived over the physical transmission media into packets conforming to the standards set forth in IEEE 8()2.3. The packet is stored in FIFO 24.
20 Processor 38 reads t:he source=~ IP address for the packet at step 52, and compares the source IP address with list 33, wtlic:~ is stored in I>RAM bank 32, at step 54. List 33 is stored in DRAM band: 32 in order to increase the speed at which data from the list could be retrieved by processor 38, as compared to, e.g., when data is stored on some other computer readable medium such as a hard drive or floppy disk. Step 56 comprises a test to determine whei:her there is a match at step 54. If there is a match at step 54, then 30 packet filter processor .'~8 rec:ord;~~ the attempt at step 58 before passing control to step 60. If there is not a match at step 54, then control ~.5 directly passed to step 60.
1 ?.
Packet filter processor 14 determines whether the packet should be passed at stF~p 6() . The decision whether to pass the packet or not is dependent upon the mode in which processor 14 is currently 5 configured, Packet f~_1_ter_ processor 14 has a restrictive mode and a permissive mode. Restrictive mode refers to a condition where a select number of packets are to be passed, and all others blocked.
Permissive mode is wl-~ere all packets are to be passed 10 except for a select few that require blocking. Thus, in permissive mode, t:he packet is passed if the source IP address for a packet does not match an address on list 33. If there is a match, packet filter processor 14 drops the packet. In restrictive mode, the packet 15 is passed if t;he source ~P address does match an address from list 33, and is dropped otherwise.
At step 60, packet filter processor 14 determines whether the packet should be posse?d depending on whether packet filter processor 14 has been set to 20 permissive mode or restrictive mode. If packet filter processor 14 has been set to restrictive mode, and there is a match at step 56, then the packet is passed at step 62 to tine des~tinat.ion net~,~erk which in this embodiment of the .invention is network 16 or terminal 25 18. If packet filter processor 14 has been set to restrictive mode, and there is not a match at step 56, then the packet is dropped at ste~3 64. Conversely, if packet filter processor 14 has been set to permissive mode, and there is a match at step 56, then the packet 30 is dropped at step 64. If. packet filter processor 14 has been set to permissive mode, and there is not a match at step 56, then the packet is passed to the destination network at step 62. Irv this embodiment of the invention, a default condition is that no feedback is given to the system sending thF, packets for security reasons if ~~ packet i.s dropped at step 64. It can be appreciated, however, that this default 5 condition can be changed and stil_i. fall within the scope of the i.nventic>n.
In accordance with the system administration aspects of the ;~nvent~ion, a service provider administers a database of scuxce :~-P address lists.
10 Each list may cont~~irl the TP addresses of particular types of Internet ~it:.es. The service provider keeps these lists up to ~~ate and period~.cally updates list 33 stored in DRAM bar7k 32 of packet filter processor 14. In this manner, end users can be assured that the 15 source IP address .Lists stored in their filtering processor are up to date.
List 33 care be updated in at least two ways.
First, list 33 would be updated by connecting Data Terminal Equipment (f>TE~) such :~s m asynchronous 20 (ASCII) terminal (or per>onal com~juter emulating an asynchronous terminal) to RS-232 connector 34 of packet filter processor 7.4. This method would enhance security when. updating list 3:3.
Alternatively, a network canr~ection is formed 25 with a central administrative sit<: equipped with a list server 70, preferably thr.ougrE an Internet Service Provider (ISP) using a direct network connection or via RS-232 connector 34. List 33 s then updated from the central administrative site, either by a request 30 by the list server 70 of the administrative site, or on the request of packet filter processor 14. List server 70 is described in more detail with reference to FIG. 4.
13a FIG. 4 is a block diagram of a list server suitable for practicing one embodiment of the invention. List server 70 comprises a main memory module 72, a central processing unit (CPU) 74, a system control module 82, a bus adapter 76, a list replication module 78, and a user interface module 80, each of which is connected to a CPU/memory bus 84 and an Input/output (I/0) bus 86 via bus adapter 76.
Further, list server 70 contains multiple I/O
controllers 88, as well as an external memory 90, a database 92 and network interface 94, each of which is connected to I/0 bus 86 via I/O controllers 88.
The overall functioning of list server 70 is controlled by CPU 74, which operates under the control of executed computer program instructions that are stored in main memory 72 or external memory 90. Both main memory 72 and external memory 90 are machine readable storage devices. The difference between main memory 72 and external memory 90 is that CPU 74 can typically access information stored in main memory 72 faster than information stored in external memory 90.
Thus, for example, main memory 72 may be any type of machine readable storage device, such as random access memory (RAM), read only memory (ROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), electronically erasable programmable read only memory (EEPROM). External memory 90 may be any type of machine readable storage device, such as magnetic storage media (~.e., a magnetic disk), or optical storage media (i-e., a CD-ROM). Further, list server 70 may contain various combinations of machine readable storage devices through other I/O controllers, which are accessible by CPU 74, and which are capable of storing a combination of computer program instructions and data.
CPU 74 includes any processor of sufficient processing power to perform the functionality found in list server 70. Examples of CPUs suitable to practice the invention includes the INTEL family of processors, such as the Pentium~, Pentium~ Pro, and Pentium~ II
microprocessors.
Network interface 94 is used for communications between list server 70 and a communications network, such as the Public Switched Telephone Network (PSTN) or the Internet. Network interface 94 supports appropriate signaling, ringing functions and voltage levels, in accordance with techniques well known in the art.
I/O controllers 88 are used to control the flow of information between list server 70 and a number of devices or networks such as external memory 90, database 92 and network interface 94. System control module 82 includes human user system control and operation. Bus adapter 76 is used for transferring data back and forth 5 between CPU/memory bus 84 and I/O bus 86.
List replication module 78 and user interface module 80 implements the main functionality for list server 70. It is noted that modules 78 and 80 are shown as separate functional modules in FIG. 4. It can be 10 appreciated, however, that the functions performed by these modules can be further separated into more modules, combined together to form one module, or be distributed throughout the system, and still fall within the scope of the invention. Further, the functionality 15 of these modules may be implemented in hardware, software, or a combination of hardware and software, using well-known signal processing techniques.
List server 70 operates as follows. A profile is established for each packet filter processor customer subscribing to the list updating service. The profile contains a copy of list 33 for each packet filter processor. List 33 at list server 70 is updated with new source IP addresses on a periodic basis. Similarly, old or invalid source IP addresses are removed from list 33 on a periodic basis.
The updating of list 33 at list server 70 can be accomplished in two ways. First, the central administrator for list server 70 obtains new source IP
address information from various sources, such as service providers or search robots specializing in gathering source IP addresses by category, telemarketers, adult material, advertising entities, hate groups, and so forth. The central administrator for list server 70 then updates list 33 at list server 70 with the new source IP address information in a timely manner, ea., within hours of receiving the new information. Second, the user of a packet filter processor can access list server 70 via user interface module 80, and perform updates to list 33 at list server 70 directly. The user could update list server 70 in a variety of ways, such as adding, deleting or modifying the source IP addresses of list 33 stored in database 92 of list server 70.
Once list 33 at list server 70 is updated, list replication module sends updated list 33 to each packet filter processor according to the profile of each packet filter processor. The profile for each packet filter processor contains information regarding when and how often list 33 at list server 70 is to be replicated to the packet filter processor. For example, list 33 at list server 70 can be replicated to a packet filter processor on a periodic basis, such as every day at a certain time, or whenever a change to list 33 at list server 70 is performed. In addition, a user of a packet filter processor may request an update of list 33, such as when the user has modified list 33 at server 70, or in the event list 33 at the packet filter processor has become corrupted or lost.
In addition to updating existing lists for packet filter processors, list server 70 has predetermined lists of source IP addresses by category. For example, a list of source IP addresses for all Internet sites containing adult material can be pre-established, and therefore readily replicated to a packet filter processor by a user simply accessing the central administrative site and making a request. Other lists for telemarketing firms, non-business related web sites, a competitor's network devices, government web sites, and so forth, could also be pre-established and made available for a user of the packet filter processor.
Although various embodiments are specifically illustrated and described herein, it will be appreciated that modifications and variations of the present invention are covered by the above teachings and within the purview of the appended claims without departing from the spirit and intended scope of the invention.
For example, although a specific network topology has been illustrated in FIG. 1, it can be appreciated that any type of network configuration would be suitable for practicing the various embodiments of the present invention. In another example, although specific equipment was illustrated in FIG. 2 for a particular type of medium access technique, it can be appreciated that the packet filter processor shown in FIG. 2 can be modified to include equipment for any type of medium access technique, such as IEEE 802.2, 802.4, 802.5, 802.12 and so forth, and still fall within the scope of the invention.
Claims (9)
1. An apparatus for updating packet filtering devices, comprising:
a database for storing a plurality of data packet origination address lists, with each list comprising a plurality of data packet origination addresses;
means for selecting at least one list from said plurality of data packet origination address lists for sending to at least one packet filtering device; and an output means for sending said selected list to said at least one packet filtering device via a communication network at predetermined intervals.
a database for storing a plurality of data packet origination address lists, with each list comprising a plurality of data packet origination addresses;
means for selecting at least one list from said plurality of data packet origination address lists for sending to at least one packet filtering device; and an output means for sending said selected list to said at least one packet filtering device via a communication network at predetermined intervals.
2. The apparatus of claim 1, further comprising a means for updating said lists by performing at least one function from a group of functions comprising adding an origination address to a list, deleting an origination address from a list, and modifying an origination address from a list.
3. The apparatus of claim 2, wherein said output means sends one of said selected lists when one of said selected lists have been updated.
4. The apparatus of claim 1, wherein said output means sends said selected lists in response to requests from said particular packet filtering devices.
5. The apparatus of claim 1, wherein said network is a fixed wireless network.
6. A method for updating a packet filter processor, comprising the steps of:
storing a plurality of data packet origination address lists, with each list comprising a plurality of data packet origination addresses;
selecting at least one list from said plurality of data packet origination address lists for transfer to at least one end user device; and sending said selected list to said at least one end user device at predetermined intervals.
storing a plurality of data packet origination address lists, with each list comprising a plurality of data packet origination addresses;
selecting at least one list from said plurality of data packet origination address lists for transfer to at least one end user device; and sending said selected list to said at least one end user device at predetermined intervals.
7. The method of claim 6, further comprising the step of updating said lists by performing at least one step from a group of steps comprising adding an origination address to a list, deleting an origination address from a list, and modifying an origination address from a list.
8. The method of claim 7, wherein said selected lists are sent when one of said selected lists have been updated.
9. The method of claim 6, wherein said selected lists are sent in response to a request from said packet filter device.
Applications Claiming Priority (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US08/956,990 US6158008A (en) | 1997-10-23 | 1997-10-23 | Method and apparatus for updating address lists for a packet filter processor |
| US08/956,990 | 1997-10-23 | ||
| PCT/US1998/022072 WO1999021339A1 (en) | 1997-10-23 | 1998-10-20 | A method and apparatus for updating address lists for a packet filter processor |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CA2272056A1 CA2272056A1 (en) | 1999-04-29 |
| CA2272056C true CA2272056C (en) | 2003-09-23 |
Family
ID=25498934
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA002272056A Expired - Fee Related CA2272056C (en) | 1997-10-23 | 1998-10-20 | A method and apparatus for updating address lists for a packet filter processor |
Country Status (3)
| Country | Link |
|---|---|
| US (1) | US6158008A (en) |
| CA (1) | CA2272056C (en) |
| WO (1) | WO1999021339A1 (en) |
Families Citing this family (41)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CA2283964C (en) | 1997-03-12 | 2008-05-06 | Nomadix, Llc | Nomadic translator or router |
| US6779118B1 (en) * | 1998-05-04 | 2004-08-17 | Auriq Systems, Inc. | User specific automatic data redirection system |
| US7194554B1 (en) | 1998-12-08 | 2007-03-20 | Nomadix, Inc. | Systems and methods for providing dynamic network authorization authentication and accounting |
| US8713641B1 (en) | 1998-12-08 | 2014-04-29 | Nomadix, Inc. | Systems and methods for authorizing, authenticating and accounting users having transparent computer access to a network using a gateway device |
| US8266266B2 (en) | 1998-12-08 | 2012-09-11 | Nomadix, Inc. | Systems and methods for providing dynamic network authorization, authentication and accounting |
| US6772346B1 (en) * | 1999-07-16 | 2004-08-03 | International Business Machines Corporation | System and method for managing files in a distributed system using filtering |
| AU7443500A (en) * | 1999-09-24 | 2001-04-24 | Comverse Network Systems, Ltd. | System and method for presorting rules for filtering packets on a network |
| US8190708B1 (en) | 1999-10-22 | 2012-05-29 | Nomadix, Inc. | Gateway device having an XML interface and associated method |
| US6477583B1 (en) * | 1999-11-15 | 2002-11-05 | Novell, Inc. | Infrastructure for supporting file replications |
| FI110975B (en) * | 1999-12-22 | 2003-04-30 | Nokia Corp | Prevention of fraud in telecommunication systems |
| US6496935B1 (en) * | 2000-03-02 | 2002-12-17 | Check Point Software Technologies Ltd | System, device and method for rapid packet filtering and processing |
| US8972590B2 (en) | 2000-09-14 | 2015-03-03 | Kirsten Aldrich | Highly accurate security and filtering software |
| US7587499B1 (en) * | 2000-09-14 | 2009-09-08 | Joshua Haghpassand | Web-based security and filtering system with proxy chaining |
| JP3637863B2 (en) * | 2000-11-01 | 2005-04-13 | 日本電気株式会社 | Virtual network and virtual network connection method |
| US6915351B2 (en) * | 2000-12-18 | 2005-07-05 | Sun Microsystems, Inc. | Community separation control in a closed multi-community node |
| EP1371242A1 (en) * | 2001-03-14 | 2003-12-17 | Nokia Corporation | Method for activating a connection in a communications system, mobile station, network element and packet filter |
| WO2002075539A2 (en) * | 2001-03-16 | 2002-09-26 | Novell, Inc. | Client-server model for synchronization of files |
| US6920493B1 (en) * | 2001-03-19 | 2005-07-19 | Networks Associates Technology, Inc. | System and method for communicating coalesced rule parameters in a distributed computing environment |
| JP3590936B2 (en) * | 2001-10-06 | 2004-11-17 | テラス テクノロジーズ，インコーポレイテッド | E-mail service system having dynamic IP filtering module and dynamic IP address filtering method |
| US7360242B2 (en) | 2001-11-19 | 2008-04-15 | Stonesoft Corporation | Personal firewall with location detection |
| US7325248B2 (en) * | 2001-11-19 | 2008-01-29 | Stonesoft Corporation | Personal firewall with location dependent functionality |
| DE60139883D1 (en) * | 2001-11-29 | 2009-10-22 | Stonesoft Oy | Custom firewall |
| EP1383327B1 (en) * | 2002-06-11 | 2013-12-25 | Panasonic Corporation | Content distributing system and data-communication controlling device |
| US7302488B2 (en) * | 2002-06-28 | 2007-11-27 | Microsoft Corporation | Parental controls customization and notification |
| US7490348B1 (en) | 2003-03-17 | 2009-02-10 | Harris Technology, Llc | Wireless network having multiple communication allowances |
| EP1658700B1 (en) * | 2003-08-29 | 2008-06-25 | Nokia Corporation | Personal remote firewall |
| US7697545B1 (en) * | 2004-07-14 | 2010-04-13 | Computer Associates Think, Inc. | Discovery of component relationships in distributed data processing networks |
| US20060041935A1 (en) * | 2004-08-17 | 2006-02-23 | Conley James W | Methodology for configuring network firewall |
| GB2425912A (en) * | 2005-05-04 | 2006-11-08 | Psytechnics Ltd | Packet filtering |
| WO2007035725A2 (en) * | 2005-09-19 | 2007-03-29 | Schweitzer Engineering Laboratories, Inc. | Method and apparatus for routing data streams among intelligent electronic devices |
| JP4489676B2 (en) * | 2005-09-28 | 2010-06-23 | 富士通株式会社 | Communications system |
| US7802296B2 (en) * | 2006-08-23 | 2010-09-21 | Cisco Technology, Inc. | Method and system for identifying and processing secure data frames |
| US7755872B2 (en) * | 2006-09-14 | 2010-07-13 | Schweitzer Engineering Laboratories, Inc. | System, method and device to preserve protection communication active during a bypass operation |
| US8046492B1 (en) * | 2007-11-06 | 2011-10-25 | Juniper Networks, Inc. | Offset independent filtering |
| US8488601B1 (en) * | 2011-07-12 | 2013-07-16 | Qlogic, Corporation | Method and system for link aggregation |
| US8467395B1 (en) | 2011-07-12 | 2013-06-18 | Qlogic, Corporation | Method and system for link aggregation |
| US9467326B2 (en) * | 2012-12-03 | 2016-10-11 | Hewlett-Packard Development Company, L.P. | Rate limiting mechanism based on device load/capacity or traffic content |
| FR3003054B1 (en) * | 2013-03-06 | 2016-08-19 | Sagem Defense Securite | METHOD AND DEVICE FOR FILTERING TRANSACTIONS FOR SYSTEM ON CHIP |
| US10924452B1 (en) * | 2013-08-30 | 2021-02-16 | Amazon Technologies, Inc. | Auditing IP address assignments |
| US11258762B2 (en) * | 2019-06-26 | 2022-02-22 | Blackberry Limited | Method and system for updating of an application layer for a third-party telematics provider |
| US11329956B2 (en) | 2020-07-28 | 2022-05-10 | Bank Of America Corporation | Scalable encryption framework using virtualization and adaptive sampling |
Family Cites Families (22)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US4184117A (en) * | 1956-04-16 | 1980-01-15 | The United States Of America As Represented By The Secretary Of The Army | Communication security method and system |
| US4888796A (en) * | 1987-08-31 | 1989-12-19 | Olivo Jr John W | Program material screening device |
| US5172111A (en) * | 1987-08-31 | 1992-12-15 | Olivo Jr John W | Stored media screening device |
| EP0398492B1 (en) * | 1989-05-15 | 1997-01-22 | International Business Machines Corporation | A flexible interface to authentication services in a distributed data processing system |
| EP0645028B1 (en) * | 1992-06-12 | 1997-12-29 | The Dow Chemical Company | Secure front end communication system and method for process control computers |
| KR960014983B1 (en) * | 1992-08-31 | 1996-10-23 | 가부시끼가이샤 도시바 | Local area network bridge apparatus with dedicated packet fittering mechanism |
| EP0601860B1 (en) * | 1992-12-10 | 1999-10-27 | Matsushita Electric Industrial Co., Ltd. | Server and client |
| US5448698A (en) * | 1993-04-05 | 1995-09-05 | Hewlett-Packard Company | Inter-processor communication system in which messages are stored at locations specified by the sender |
| US5606668A (en) * | 1993-12-15 | 1997-02-25 | Checkpoint Software Technologies Ltd. | System for securing inbound and outbound data packet flow in a computer network |
| US5615340A (en) * | 1994-07-21 | 1997-03-25 | Allied Telesyn Int'l Corp. | Network interfacing apparatus and method using repeater and cascade interface with scrambling |
| US5627886A (en) * | 1994-09-22 | 1997-05-06 | Electronic Data Systems Corporation | System and method for detecting fraudulent network usage patterns using real-time network monitoring |
| US5553315A (en) * | 1994-11-08 | 1996-09-03 | Motorola, Inc. | Method of maintaining access authorization using a bulletin board communication resource |
| US5632011A (en) * | 1995-05-22 | 1997-05-20 | Sterling Commerce, Inc. | Electronic mail management system for operation on a host computer system |
| US5678041A (en) * | 1995-06-06 | 1997-10-14 | At&T | System and method for restricting user access rights on the internet based on rating information stored in a relational database |
| US5696898A (en) * | 1995-06-06 | 1997-12-09 | Lucent Technologies Inc. | System and method for database access control |
| US5757924A (en) * | 1995-09-18 | 1998-05-26 | Digital Secured Networks Techolognies, Inc. | Network security device which performs MAC address translation without affecting the IP address |
| WO1997026735A1 (en) * | 1996-01-16 | 1997-07-24 | Raptor Systems, Inc. | Key management for network communication |
| US5684951A (en) * | 1996-03-20 | 1997-11-04 | Synopsys, Inc. | Method and system for user authorization over a multi-user computer system |
| US5828833A (en) * | 1996-08-15 | 1998-10-27 | Electronic Data Systems Corporation | Method and system for allowing remote procedure calls through a network firewall |
| US5802319A (en) * | 1996-10-23 | 1998-09-01 | Hewlett-Packard Company | Method and apparatus for employing an intelligent agent to cause a packet to be sent to update a bridge's filtering database when a station is moved in a network |
| US5889958A (en) * | 1996-12-20 | 1999-03-30 | Livingston Enterprises, Inc. | Network access control system and process |
| US6035423A (en) * | 1997-12-31 | 2000-03-07 | Network Associates, Inc. | Method and system for providing automated updating and upgrading of antivirus applications using a computer network |
-
1997
- 1997-10-23 US US08/956,990 patent/US6158008A/en not_active Expired - Lifetime
-
1998
- 1998-10-20 WO PCT/US1998/022072 patent/WO1999021339A1/en active Application Filing
- 1998-10-20 CA CA002272056A patent/CA2272056C/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| WO1999021339A1 (en) | 1999-04-29 |
| CA2272056A1 (en) | 1999-04-29 |
| US6158008A (en) | 2000-12-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA2272056C (en) | A method and apparatus for updating address lists for a packet filter processor | |
| US6874026B2 (en) | Method and apparatus for filtering packets using a dedicated processor | |
| CN100399764C (en) | Multibusiness network exchanger | |
| US6084892A (en) | Public IP transport network | |
| US6717943B1 (en) | System and method for routing and processing data packets | |
| US6097719A (en) | Public IP transport network | |
| EP0567217A2 (en) | System of extending network resources to remote networks | |
| CN100399763C (en) | Multi-service network switch | |
| Cisco | Managing Your Catalyst 3900 | |
| Cisco | Gateway System Manual | |
| Cisco | Gatway Systems Manual | |
| Cisco | Managing Your Catalyst 3900 | |
| Cisco | Managing Your Catalyst 3900 | |
| Cisco | Managing Your Catalyst 3900 | |
| Cisco | Managing Your Catalyst 3900 | |
| Cisco | Gateway Systems Manual | |
| Cisco | Switch show Commands | |
| Varghese et al. | Transparent interconnection of incompatible local area networks using bridges | |
| Cisco | Implementing the SNMP Agent | |
| Cisco | Gateway System Manual For use with the Cabletron MMAC Hub | |
| JP2002314569A (en) | Transfer device and transfer control method | |
| EP1686756B1 (en) | Communication system, method and apparatus for providing mirroring service in the communication system | |
| Cisco | Gateway Systems Manual | |
| Cisco | Router Products Configuration and Reference Volume I Software Release 9.1 September 1992 | |
| Cisco | Router Products Command Reference Addendum Internetwork Operating System Release 10.2 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request | ||
| MKLA | Lapsed |