Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1999-04-07
2003-09-02
Hayes, Gail (Department: 2131)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C370S229000, C370S395520
Reexamination Certificate
active
06615358
ABSTRACT:
FIELD OF THE INVENTION
The present invention relates, in general, to information processing system organization and, in particular, to input and output data processing flow controlling.
BACKGROUND OF THE INVENTION
A firewall is a device for, or method of, controlling the connectivity of one computer network to another. A firewall is commonly referred to as a packet filter or a gateway and is used, mainly, to provide security for a computer network. For example, a user may wish to have a private computer network be remotely accessible from a public computer network by certain users (e.g., employees) but not by others (e.g., hackers). Here, a firewall may be placed between the private computer network and the public computer network to allow only authorized users to access the private computer network from the public network.
An example of a public computer network is the Internet. Communication over the Internet is conducted using certain protocols. These protocols allow users with different computers and different operating systems to communicate with each other over the Internet. Typical Internet protocols include the Transmission Control Protocol (TCP) and the Internet Protocol (IP). Other Internet-compatible protocols are based on TCP and IP.
In IP, a data stream to be transmitted is divided into a number of packets, where each packet contains the same IP header information. A source address and a destination address of the data stream are added to each packet along with instructions on how to recombine the packets to obtain the original data stream. The source address identifies from where in the network the packet came while the destination address identifies to where in the network the packet is to be sent (i.e., the endpoint, or collection of endpoints, of the data stream). A series of packets, each identified by the same source address and the same destination addresses is commonly referred to as a flow. With these addresses, there is no need for the packet to take the same route to the destination address. By allowing the packets to travel different routes, the sudden unavailability of a transmission path over which previously transmitted packets travelled will not result in an incomplete transmission. Here, subsequently transmitted packets would be sent over a different available transmission path. Since IP does not require data to be sent over a single fixed connection, a network that employs IP is commonly referred to as a connectionless network. A goal of a connectionless network is to increase the probability that a data stream will reach its destination address, but there is a performance penalty (e.g., transmission time, latency, variance of delay, etc.) associated with the additional information added to each packet. To satisfy the need for higher performance, a communication protocol named Asynchronous Transmission Mode (ATM) was developed.
In ATM, communication takes place in two steps. In the first step is to establish a transmission path over which a data stream will be transmitted. Since the data stream will be sent over the established transmission path, ATM is commonly referred to as a connection-oriented network. A signal containing a request to establish a transmission path is transmitted in segments, where each segment is referred to as an ATM cell and, more particularly, as an ATM signalling segment. The transmitted segments are reassembled at the destination address to reconstruct the connection request the connection request is then analyzed to determine whether or not to establish the transmission path.
If the transmission path is established, the second step is to transmit the data stream. The data stream is transmitted in segments, where each segment is also be referred to as an ATM cell but, more particularly, as an ATM data segment. The transmitted ATM data segments are then recombined at the destination address to for the original data stream.
A transmission path may include more than one node or link. For each link in the transmission path there must be two switches, one for the data stream to enter the link and one for the data stream to exit the link. In ATM, information must be maintained that identifies all of the links and switches that comprise the transmission path used to transmit a data stream. Instead of storing all of this information at one location, portions of the information are distributed throughout the network switches along the transmission path.
Information is added to the header of each segment to determine how to forward the cell to the next point, or hop, in the path to the destination address. The header for a segment has only edge-level significance (i.e., hop-to-hop), not end-to-end significance (i.e., source-to-destination). The header does not identify the source or the destination of the segment, but only provides enough information for the segment to be processed at the next hop in the path. Information that identifies the final destination of each segment is not included in the header, since all of the segments transmitted along a given transmission path follow the same route. For this reason, the headers in connectionless networks (i.e., IP) tend to be larger than headers in connection-oriented networks (i.e., ATM). The smaller header sizes and fixed cel sizes of the connection-oriented networks make it easier for the switches to process the information. Therefore, connection-oriented networks tend to be efficient and support high transmission speeds.
Some networks combine IP and ATM by transmitting IP packets over an ATM transmission channel. This is commonly referred to as IP over ATM. Here, an IP packet is divided into segments. Each segment is then made part of an ATM data segment and transmitted over the ATM network as an ATM cell.
Simply combining the capabilities of an ATM firewall with those of an IP firewall does not, necessarily, yield a more efficient or more secure firewall for an IP over ATM network. The present invention is a secure and efficient firewall that applies a security posture to connectionless network data packets (e.g., IP data packets) transmitted over a connection-oriented network (e.g., ATM).
The closest prior art to the present invention appears to be the present inventor's own previous work published in a paper entitled “An FPGA-Based Coprocessor for ATM Firewalls,” by the IEEE Computer Society, Los Alamitos, Calif., on Apr. 16, 1997, in
Proceedings, The
5
th a Annual IEEE Symposium on Field
-
Programmable Custom Computing Machines
. The device disclosed in this publication is the subject of a patent application Ser. No. 09/059,041, filed Apr. 13, 1998, entitled “FIREWALL SECURITY APPARATUS FOR HIGH-SPEED CIRCUIT SWITCHED NETWORKS which is now U.S. Pat. No. 6,141,755.”
FIG. 1
lists the steps of the method disclosed in the above-identified publication. The first step
1
is initializing a database and a connection-oriented network approved list, where the database contains rules for allowing and denying access concerning connection-oriented network flows, and where the connection-oriented approved list includes approvals of flows carrying ATM signaling information and ATM data.
The next step
2
is receiving a datagram. The present invention uses the term datagram to mean a unit of information. Acceptable units of information for the method of
FIG. 1
includes an ATM signaling segment or an ATM data segment.
The next step
3
is identifying the type of the datagram (i.e., ATM signaling segment or ATM data segment).
The next step
4
is allowing the datagram access to the information processing network, recording that the datagram was allowed access to the information processing network, and comparing the connection request contained therein to the database if the datagram is an ATM signaling segment.
The next step
5
is adding the connection request to the connection-orientednetwork approved list if the connection request is approved by the database and returning to the second step
2
. If the connection request is not approved by the database then return to the second
Dowd Patrick W.
McHenry John T.
Hayes Gail
Morelli Robert D.
Revak Christopher
LandOfFree
Firewall for processing connection-oriented and... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Firewall for processing connection-oriented and..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Firewall for processing connection-oriented and... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3062537