Electrical computers and digital processing systems: multicomput – Computer-to-computer session/connection establishing – Network resources access controlling
Reexamination Certificate
1999-09-03
2004-06-22
Powell, Mark R. (Department: 2142)
Electrical computers and digital processing systems: multicomput
Computer-to-computer session/connection establishing
Network resources access controlling
C709S224000, C709S227000
Reexamination Certificate
active
06754713
ABSTRACT:
FIELD AND BACKGROUND OF THE INVENTION
The present invention relates to local area networks, and wide area networks which consists of at least one local area network, for providing communication between computers and/or other network connected devices. The communication is based on well known communication rules, known as protocols (a set of rules) known to all parties participating in a session. A session is a conversation between two or more parties using a standard protocol. A party that initiates a session is called “client.” A party that is connected to the client and accepts an invitation to join a session is called a “server.” A session is always established by a client inviting one or more servers to attend. Additional clients may attend as well.
More particularly, the present invention relates to a method and means for restricting the access of specific clients to specific servers for specific protocols or data content. This is accomplished using a device located on the network and capable of passively listening to network traffic, analyzing it and responding to it when access is to be denied.
Presently, there are a number of solutions available for controlling communications over a network. One such controlling apparatus is a firewall. This is a machine located between an internal network and external networks connected thereto. The only way to communicate outside of the internal network is through the firewall. Therefore, a firewall is known as an active device that is managed for access control, and, in some cases, for authentication and encryption. By placing firewalls at strategic points between network segments, using routers, bridges and repeaters, it is possible to use this technology for access control between network stations located on different network segments. However, this solution is effectively limited, because a server station must reside on a different network segment than the communicating client station in order to monitor the communication. Internal intruders may install their own devices on the segment behind the firewall and thus get unlimited access to all machines inside the secured local area network. Also, because a firewall requires that all network traffic to pass through it and be processed for access control, the firewall causes a degradation in the throughput of the network. Accordingly, a firewall is also known as a network bottleneck.
Other methods for controlling communications over a network are various software products that implement secured protocols which include authentication. Using such software, the client identifies itself either directly or using an authentication trusted server; the server (in the communication) reciprocates by identifying itself as well. Using a pre defined security protocol, both parties either accept or deny the session. This requires both parties to use the same security protocol. This method also carries an implied trust in the authentication server when such a server is employed.
There is therefore a need for, and it would be highly advantageous to have, a passive network device that provides access control at a requested level over a local area network and a wide area network without using conventional software security and authentication methods.
SUMMARY OF THE INVENTION
The present invention is a session wall for monitoring and controlling communications over a computer network.
According to the teachings of the present invention there is provided, a session wall device featuring a network adapter for attaching the session wall to a network, a memory, a processor, all suitably interconnected and a communication session control system. The memory is any medium for data storage, such as, but not limited to Flash memory, conventional magnetic memory disk or diskette, and Read Only Memory (ROM). The processor functions to perform the various tasks associated with the network session control system. The network adapter is any hardware component enabling network communication between a session wall device and another network device. According to a preferred embodiment, the network adapter receives communications in several protocols simultaneously and transmits messages in several protocols.
The communication session control system features data pertinent to the control of communication between network devices, stored in the memory. This data includes network information and access information. Network information includes information regarding the network, such as network topology, defining which network devices are servers and which are clients and defining the communication protocols between network devices. Access information is a set of rules typically realized as a table of groups of servers, groups of clients, and rules between them. The rules define actions that should take place when a specific set of protocols are used when the two or more parties communicate, and optionally, specific data content, or specific data sequences to be passed over the network. According to further features in preferred embodiments of the invention, the rules contain logical and mathematical combinations according to which a specific action is to be performed.
The session control system passively listens to communications traversing the network and reads a portion of each communication. It then compares the data read with the access data in order to determine whether the message is permitted or not. If the communication is not allowed, the session wall issues a message to at least one of the devices involved in the communication. The term ‘listen’ in the context of the present invention is directed at the process of an electronic device receiving data communication. Thus, the term ‘passive listening’ is directed at an electronic device receiving data communication not designated for the device without interfering in any way with the transmission of that communication to its intended destination.
According to further features in preferred embodiments of the invention described below, the device to which the message is sent is a client.
According to further features in preferred embodiments of the invention, the message issued features either an emulated message from a respective server, a notice that a respective server has ended the session, or a notice that the session has been blocked, or any combination thereof.
According to further features in preferred embodiments of the invention, the device to which the message is sent is a server.
According to further features in preferred embodiments of the invention, the message sent to the server features either an emulated message from a respective client to end the current session or a data string causing the server not to respond to additional messages from the respective client in the current session, or both.
According to still further features in preferred embodiments of the invention described below, the session wall issues two different messages: one to the client and another to the server.
According to further features in preferred embodiments of the invention described below, when the session wall fails to issue an appropriate message, it issues a succession of communication messages (conforming to the appropriate system protocol) in order to block transmission by another network device. A further feature according to this embodiment is to provide a timer configured to limit the number of consecutive messages sent in order not to block the network indefinitely. The timer is realized either as a separate device, or as software executed by the processor.
According to the teachings of the present invention, there is also provided a method for controlling communication between network devices including the steps of:
(a) providing network information;
(b) providing access information;
(c) reading portions of communication traversing the network;
(d) comparing the read communication with the access information; and
(e) when the communication is not allowed according to the access information, issuing any of the aforementioned messages to an appropriate network devic
Cardone Jason D.
Computer Associates Think Inc.
Cooper & Dunham LLP
Powell Mark R.
LandOfFree
System and method of controlling communication sessions does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System and method of controlling communication sessions, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System and method of controlling communication sessions will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3321177