Patent US5414833A successfully refreshed from Google Patents.
US5414833A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Network security system and method using a parallel finite state machine adaptive active monitor and responder
Assignee: International Business Machines Corp
•
Filing: 1993-10-27
•
Granted: 1995-05-09
•
Expires: 2013-10-27
Abstract
Abstract A system and method provide a security agent, consisting of a monitor and a responder, that respond to a detected security event in a data communications network, by producing and transmitting a security alert message to a network security manager. The alert is a security administration action which includes setting a flag in an existing transmitted protocol frame to indicate a security event has occurred. The security agent detects the transmission of infected programs and data across a high-speed communications network. The security agent includes an adaptive, active monitor using finite state machines, that can be dynamically reprogrammed in the event it becomes necessary to dynamically reconfigure it to provide real time detection of the presence of a suspected offending virus.
Inventors
- 👤 Paul C. Hershey
- 👤 Donald B. Johnson
- 👤 An V. Le
- 👤 Stephen M. Matyas
- 👤 John G. Waclawsky
- 👤 John D. Wilkins
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-25 23:55
CPC Classifications
H; H04; H04L; H04L43/00; G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/56; G06F21/562; G06F21/564; H04L63/00; H04L63/04; H04L63/0428; H04L63/14; H04L63/1441; H04L63/145; G06F11/00; G06F11/07; G06F11/0703; G06F11/0751; G06F11/0763; G06F11/30; G06F11/32; G06F11/324; G06F11/327
Claims Analysis
Total Claims: 50
Claim 1
Independent Claim
373 words
A network security architecture system, with an adaptable, simultaneously parallel array of finite state machines, for monitoring the security of a data communications network, comprising: a first finite state machine in said array, including a first memory, a first address register coupled to said network, a first start signal input and a first security threat pattern detection output coupled to a first counter, said memory thereof storing a first finite state machine definition for detecting a first data security threat pattern on said network; a second finite state machine in said array, including a second memory, a second address register coupled to said network, a second start signal input and a second security threat pattern detection output coupled to a second counter, said memory thereof storing a second finite state machine definition for detecting a second data security threat pattern on said network; a third finite state machine in said array, including a third memory, a third address register coupled to said network, a third start signal input and a third security threat pattern detection output coupled to a third counter, said memory thereof storing a third finite state machine definition for detecting a third data security threat pattern on said network; a programmable interconnection means coupled to said first, second and third finite state machines, for selectively interconnecting said first security threat pattern detection output to at least one of said second and third start signal inputs; a security event vector assembly means, having inputs coupled to said first, second and third counters, for assembling a security event vector from an accumulated count value in said first counter and at least one of said second and third counters, representing a number of occurrences of said first data security threat pattern and at least one of said second and third data security threat patterns on said network; and a responding means, having an input coupled to said security event vector assembly means, an array output coupled to said memory of said first, second and third finite state machines, and a configuration output coupled to said programmable interconnection means, for receiving said security event vector and in response thereto, changing said array to change data security threat patterns to be detected on said network.
Claim 2
Dependent Claim
373 words
A network security architecture system, with an adaptable, simultaneously parallel array of finite state machines, for monitoring the security of a data communications network, comprising: a first finite state machine in said array, including a first memory, a first address register coupled to said network, a first start signal input and a first security threat pattern detection output coupled to a first counter, said memory thereof storing a first finite state machine definition for detecting a first data security threat pattern on said network; a second finite state machine in said array, including a second memory, a second address register coupled to said network, a second start signal input and a second security threat pattern detection output coupled to a second counter, said memory thereof storing a second finite state machine definition for detecting a second data security threat pattern on said network; a third finite state machine in said array, including a third memory, a third address register coupled to said network, a third start signal input and a third security threat pattern detection output coupled to a third counter, said memory thereof storing a third finite state machine definition for detecting a third data security threat pattern on said network; a programmable interconnection means coupled to said first, second and third finite state machines, for selectively interconnecting said first security threat pattern detection output to at least one of said second and third start signal inputs; a security event vector assembly means, having inputs coupled to said first, second and third counters, for assembling a security event vector from an accumulated count value in said first counter and at least one of said second and third counters, representing a number of occurrences of said first data security threat pattern and at least one of said second and third data security threat patterns on said network; and a responding means, having an input coupled to said security event vector assembly means, an array output coupled to said memory of said first, second and third finite state machines, and a configuration output coupled to said programmable interconnection means, for receiving said security event vector and in response thereto, changing said array to change data security threat patterns to be detected on said network.
Claim 3
Dependent Claim
59 words
The system of claim 1, wherein said responding means, in response to receiving said security event vector, changes a first interconnection arrangement of said first security threat pattern detection output being connected to said second start signal input, to a second interconnection arrangement of said first security threat pattern detection output being connected to said third start signal input.
Claim 4
Dependent Claim
74 words
The system of claim 1, wherein said responding means, in response to receiving said security event vector, changes a first interconnection arrangement of said first security threat pattern detection output being connected to said second start signal input, to a second interconnection arrangement of said first security threat pattern detection output being connected to both said second start signal input and to said third start signal input, for simultaneous, parallel finite state machine operation.
Claim 5
Dependent Claim
40 words
The system of claim 1, wherein said responding means, in response to receiving said security event vector, outputs new finite machine definition data to at least said first memory to change said first data security threat pattern to be detected.
Claim 6
Dependent Claim
35 words
The system of claim 1, wherein said responding means is coupled to said network, and in response to receiving said security event vector, outputs a control signal to said network to alter communication characteristics thereof.
Claim 7
Dependent Claim
15 words
The system of claim 1, wherein said security threat is the occurrence of inappropriate words.
Claim 8
Dependent Claim
16 words
The system of claim 1, wherein said security threat is the occurrence of a proprietary notice.
Claim 9
Dependent Claim
20 words
The system of claim 1, wherein said security threat is the occurrence of use of computing resources for non-authorized purposes.
Claim 10
Dependent Claim
16 words
The system of claim 1, wherein said security threat is the occurrence of copyright protected data.
Claim 11
Dependent Claim
16 words
The system of claim 1, wherein said security threat is the occurrence of company confidential information.
Claim 12
Dependent Claim
15 words
The system of claim 1, wherein said security threat is the occurrence of unencrypted data.
Claim 13
Dependent Claim
32 words
The system of claim 1, wherein said security threat is the occurrence of a plurality of intrusions by an adversary who attempts to gain access to a system using repeated login requests.
Claim 14
Dependent Claim
21 words
The system of claim 1, wherein said first, second and third finite state machines are formed on an integrated circuit chip.
Claim 15
Dependent Claim
25 words
The system of claim 1, wherein said first, second and third finite state machines are formed in task memory partitions of a multi-tasking data processor.
Claim 16
Dependent Claim
32 words
The system of claim 1, which further comprises: said responding means receiving said computer security event vector and in response thereto, performing security monitoring and control operations on said data communications network.
Claim 17
Dependent Claim
29 words
The system of claim 15, which further comprises: said responding means receiving said computer security event vector and in response thereto, transmitting a security alarm signal on said network.
Claim 18
Dependent Claim
17 words
The system of claim 1, wherein said security threat is the occurrence of a natural language pattern.
Claim 19
Dependent Claim
14 words
The system of claim 1, wherein said security threat is an intrusion detection pattern.
Claim 20
Dependent Claim
26 words
The system of claim 1, wherein said security threat is the occurrence of plaintext in said data communications network, where ciphertext is required to maintain security.
Claim 21
Dependent Claim
296 words
In a network security architecture system, with an adaptable, simultaneously parallel array of finite state machines, a method for monitoring the security of a data communications network, comprising: storing a first finite state machine definition for detecting a first data security threat pattern on said network, in a first finite state machine in said array, including a first memory, a first address register coupled to said network, a first start signal input and a first security threat pattern detection output coupled to a first counter; storing a second finite state machine definition for detecting a second data security threat pattern on said network, in a second finite state machine in said array, including a second memory, a second address register coupled to said network, a second start signal input and a second security threat pattern detection output coupled to a second counter; storing a third finite state machine definition for detecting a third data security threat pattern on said network, a third finite state machine in said array, including a third memory, a third address register coupled to said network, a third start signal input and a third security threat pattern detection output coupled to a third counter; selectively interconnecting said first security threat pattern detection output to at least one of said second and third start signal inputs; assembling a security event vector from an accumulated count value in said first counter and at least one of said second and third counters, representing a number of occurrences of said first data security threat pattern and at least one of said second and third data security threat patterns on aid network; and receiving said security event vector and in response thereto, changing said array to change data security threat patterns to be detected on said network.
Claim 22
Dependent Claim
296 words
In a network security architecture system, with an adaptable, simultaneously parallel array of finite state machines, a method for monitoring the security of a data communications network, comprising: storing a first finite state machine definition for detecting a first data security threat pattern on said network, in a first finite state machine in said array, including a first memory, a first address register coupled to said network, a first start signal input and a first security threat pattern detection output coupled to a first counter; storing a second finite state machine definition for detecting a second data security threat pattern on said network, in a second finite state machine in said array, including a second memory, a second address register coupled to said network, a second start signal input and a second security threat pattern detection output coupled to a second counter; storing a third finite state machine definition for detecting a third data security threat pattern on said network, a third finite state machine in said array, including a third memory, a third address register coupled to said network, a third start signal input and a third security threat pattern detection output coupled to a third counter; selectively interconnecting said first security threat pattern detection output to at least one of said second and third start signal inputs; assembling a security event vector from an accumulated count value in said first counter and at least one of said second and third counters, representing a number of occurrences of said first data security threat pattern and at least one of said second and third data security threat patterns on aid network; and receiving said security event vector and in response thereto, changing said array to change data security threat patterns to be detected on said network.
Claim 23
Dependent Claim
56 words
The system of claim 20, wherein in response to receiving said security event vector, changing a first interconnection arrangement of said first security threat pattern detection output being connected to said second start signal input, to a second interconnection arrangement of said first security threat pattern detection output being connected to said third start signal input.
Claim 24
Dependent Claim
71 words
The method of claim 20, wherein in response to receiving said security event vector, changing a first interconnection arrangement of said first security threat pattern detection output being connected to said second start signal input, to a second interconnection arrangement of said first security threat pattern detection output being connected to both said second start signal input and to said third start signal input, for simultaneous, parallel finite state machine operation.
Claim 25
Dependent Claim
37 words
The method of claim 20, wherein in response to receiving said security event vector, outputting new finite machine definition data to at least said first memory to change said first data security threat pattern to be detected.
Claim 26
Dependent Claim
26 words
The method of claim 20, wherein in response to receiving said security event vector, outputting a control signal to said network to alter communication characteristics thereof.
Claim 27
Dependent Claim
15 words
The method of claim 20, wherein said security threat is the occurrence of inappropriate words.
Claim 28
Dependent Claim
16 words
The method of claim 20, wherein said security threat is the occurrence of a proprietary notice.
Claim 29
Dependent Claim
20 words
The method of claim 20, wherein said security threat is the occurrence of use of computing resources for non-authorized purposes.
Claim 30
Dependent Claim
16 words
The method of claim 20, wherein said security threat is the occurrence of copyright protected data.
Claim 31
Dependent Claim
16 words
The method of claim 20, wherein said security threat is the occurrence of company confidential information.
Claim 32
Dependent Claim
15 words
The method of claim 20, wherein said security threat is the occurrence of unencrypted data.
Claim 33
Dependent Claim
32 words
The method of claim 20, wherein said security threat is the occurrence of a plurality of intrusions by an adversary who attempts to gain access to a system using repeated login requests.
Claim 34
Dependent Claim
21 words
The method of claim 20, wherein said first, second and third finite state machines are formed on an integrated circuit chip.
Claim 35
Dependent Claim
25 words
The method of claim 20, wherein said first, second and third finite state machines are formed in task memory partitions of a multi-tasking data processor.
Claim 36
Dependent Claim
29 words
The method of claim 20, which further comprises: receiving said computer security event vector and in response thereto, performing security monitoring and control operations on said data communications network.
Claim 37
Dependent Claim
26 words
The method of claim 34, which further comprises: receiving said computer security event vector and in response thereto, transmitting a security alarm signal on said network.
Claim 38
Independent Claim
580 words
A method for information collection by adaptive, active security monitoring of a serial stream of data having a characteristic virus pattern including a first occurring and a second occurring virus pattern portions, comprising the steps of: receiving x-bit words from said serial data stream, in a first n-bit address register having a first portion with n-x bits and an second portion with two bits and an input to said second portion coupled to said serial stream; accessing a first-addressable memory having a plurality of data storage locations, each having a first portion with n-x bits, said first memory having an n-bit address input coupled an output of said first address register, said first memory configured with data stored in first and second ones of said data storage locations to represent a first digital filter for said first occurring virus pattern; transferring data over a feedback path from an output of said first memory to an input of said first register, for transferring said data from said first one of said data storage locations in said first memory to said first portion of said first address register, for concatenation with said x-bit words from said serial bit stream to form an address for said second one of said data storage locations of said first memory; outputting a start signal from said second one of said data storage locations of said first memory having a start signal value stored therein, which is output when said first occurring portion of said characteristic virus pattern is detected by said digital filter; receiving x-bit words from said serial data stream, in a second p-bit address register having a first portion with p-x bits and a second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream; said second address register coupled to said first memory, for receiving said start signal value from said first memory; accessing a second addressable memory having a plurality of data storage locations, each having a first portion with p-x bits, said second memory having a p-bit address input coupled an output of said second address register, said second memory configured with data stored in first and second ones of said data storage locations to represent a second digital filter for said second occurring virus pattern; transferring data over a feedback path from an output of said second memory to an input of said second register, for transferring said data from said first one of said data storage locations in said second memory to said first portion of said second address register in response to said start signal value, for concatenation with said x-bit words from said serial data stream to form an address for said second one of said data storage locations of said second memory; outputting a security alarm value from said second one of said data storage locations of said second memory having a virus pattern security alarm value stored therein, which is output when said second portion of said characteristic virus pattern is detected by said second digital filter; counting occurrences of said second portion of said characteristic virus pattern in said data stream, with a counter coupled to said virus pattern security alarm value output, and outputting a count value as an event vector; and receiving said event vector and in response thereto, performing security monitoring and control operations on a data communications medium providing said data stream.
Claim 39
Independent Claim
580 words
A method for information collection by adaptive, active security monitoring of a serial stream of data having a characteristic virus pattern including a first occurring and a second occurring virus pattern portions, comprising the steps of: receiving x-bit words from said serial data stream, in a first n-bit address register having a first portion with n-x bits and an second portion with two bits and an input to said second portion coupled to said serial stream; accessing a first-addressable memory having a plurality of data storage locations, each having a first portion with n-x bits, said first memory having an n-bit address input coupled an output of said first address register, said first memory configured with data stored in first and second ones of said data storage locations to represent a first digital filter for said first occurring virus pattern; transferring data over a feedback path from an output of said first memory to an input of said first register, for transferring said data from said first one of said data storage locations in said first memory to said first portion of said first address register, for concatenation with said x-bit words from said serial bit stream to form an address for said second one of said data storage locations of said first memory; outputting a start signal from said second one of said data storage locations of said first memory having a start signal value stored therein, which is output when said first occurring portion of said characteristic virus pattern is detected by said digital filter; receiving x-bit words from said serial data stream, in a second p-bit address register having a first portion with p-x bits and a second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream; said second address register coupled to said first memory, for receiving said start signal value from said first memory; accessing a second addressable memory having a plurality of data storage locations, each having a first portion with p-x bits, said second memory having a p-bit address input coupled an output of said second address register, said second memory configured with data stored in first and second ones of said data storage locations to represent a second digital filter for said second occurring virus pattern; transferring data over a feedback path from an output of said second memory to an input of said second register, for transferring said data from said first one of said data storage locations in said second memory to said first portion of said second address register in response to said start signal value, for concatenation with said x-bit words from said serial data stream to form an address for said second one of said data storage locations of said second memory; outputting a security alarm value from said second one of said data storage locations of said second memory having a virus pattern security alarm value stored therein, which is output when said second portion of said characteristic virus pattern is detected by said second digital filter; counting occurrences of said second portion of said characteristic virus pattern in said data stream, with a counter coupled to said virus pattern security alarm value output, and outputting a count value as an event vector; and receiving said event vector and in response thereto, performing security monitoring and control operations on a data communications medium providing said data stream.
Claim 40
Dependent Claim
55 words
The method of claim 36, wherein said first address register and said first addressable memory are formed in a first multi-tasking memory partition of a data processor; and said second address register and said second addressable memory are formed in a second multi-tasking memory partition of said data processor, coupled to said first memory partition.
Claim 41
Dependent Claim
46 words
The method of claim 36, which further comprises: reconfiguring said first addressable memory by storing new data in said first and second ones of said data storage locations to represent a third digital filter for a third occurring virus pattern, in response to said event vector.
Claim 42
Dependent Claim
43 words
The method of claim 36, which further comprises: decoupling said first memory from said second address register and coupling said first memory to a third address register, for receiving said start signal value from said first memory, in response to said event vector.
Claim 43
Independent Claim
518 words
A method for adaptive, active security monitoring of a serial stream of data having a characteristic virus pattern including a first occurring and a second occurring virus pattern portions, comprising the steps of: receiving x-bit words from said serial data stream, in a first n-bit address register having a first portion with n-x bits and an second portion with two bits and an input to said second portion coupled to said serial stream; accessing a first addressable memory having a plurality of data storage locations, each having a first portion with n-x bits, said first memory having an n-bit address input coupled an output of said first address register, said first memory configured with data stored in first and second ones of said data storage locations to represent a first digital filter for said first occurring virus pattern; transferring data over a feedback path from an output of said first memory to an input of said first register, for transferring said data from said first one of said data storage locations in said first memory to said first portion of said first address register, for concatenation with said x-bit words from said serial bit stream to form an address for said second one of said data storage locations of said first memory; outputting a start signal from said second one of said data storage locations of said first memory having a start signal value stored therein, which is output when said first occurring portion of said characteristic virus pattern is detected by said digital filter; receiving x-bit words from said serial data stream, in a second p-bit address register having a first portion with p-x bits and a second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream; said second address register coupled to said first memory, for receiving said start signal value from said first memory; accessing a second addressable memory having a plurality of data storage locations, each having a first portion with p-x bits, said second memory having a p-bit address input coupled an output of said second address register, said second memory configured with data stored in first and second ones of said data storage locations to represent a second digital filter for said second occurring virus pattern; transferring data over a feedback path from an output of said second memory to an input of said second register, for transferring said data from said first one of said data storage locations in said second memory to said first portion of said second address register in response to said start signal value, for concatenation with said x-bit words from said serial data stream to form an address for said second one of said data storage locations of said second memory; outputting an security alarm value from said second one of said data storage locations of said second memory having a virus pattern security alarm value stored therein, which is output when said second portion of said characteristic virus pattern is detected by said second digital filter.
Claim 44
Independent Claim
518 words
A method for adaptive, active security monitoring of a serial stream of data having a characteristic virus pattern including a first occurring and a second occurring virus pattern portions, comprising the steps of: receiving x-bit words from said serial data stream, in a first n-bit address register having a first portion with n-x bits and an second portion with two bits and an input to said second portion coupled to said serial stream; accessing a first addressable memory having a plurality of data storage locations, each having a first portion with n-x bits, said first memory having an n-bit address input coupled an output of said first address register, said first memory configured with data stored in first and second ones of said data storage locations to represent a first digital filter for said first occurring virus pattern; transferring data over a feedback path from an output of said first memory to an input of said first register, for transferring said data from said first one of said data storage locations in said first memory to said first portion of said first address register, for concatenation with said x-bit words from said serial bit stream to form an address for said second one of said data storage locations of said first memory; outputting a start signal from said second one of said data storage locations of said first memory having a start signal value stored therein, which is output when said first occurring portion of said characteristic virus pattern is detected by said digital filter; receiving x-bit words from said serial data stream, in a second p-bit address register having a first portion with p-x bits and a second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream; said second address register coupled to said first memory, for receiving said start signal value from said first memory; accessing a second addressable memory having a plurality of data storage locations, each having a first portion with p-x bits, said second memory having a p-bit address input coupled an output of said second address register, said second memory configured with data stored in first and second ones of said data storage locations to represent a second digital filter for said second occurring virus pattern; transferring data over a feedback path from an output of said second memory to an input of said second register, for transferring said data from said first one of said data storage locations in said second memory to said first portion of said second address register in response to said start signal value, for concatenation with said x-bit words from said serial data stream to form an address for said second one of said data storage locations of said second memory; outputting an security alarm value from said second one of said data storage locations of said second memory having a virus pattern security alarm value stored therein, which is output when said second portion of said characteristic virus pattern is detected by said second digital filter.
Claim 45
Dependent Claim
55 words
The method of claim 40, wherein said first address register and said first addressable memory are formed in a first multi-tasking memory partition of a data processor; and said second address register and said second addressable memory are formed in a second multi-tasking memory partition of said data processor, coupled to said first memory partition.
Claim 46
Dependent Claim
573 words
An information collection architecture system for adaptive, active security monitoring of a serial stream of data having a characteristic virus pattern including a first occurring and a second occurring virus pattern portions, for performing security monitoring and control operations on a data communications medium providing said data stream, comprising: a first n-bit address register having a first portion with n-x bits and an second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream; first addressable memory having a plurality of data storage locations, each having a first portion with n-x bits, said first memory having an n-bit address input coupled an output of said first address register, said first memory configured with data stored in first and second ones of said data storage locations to represent a first digital filter for said first occurring virus pattern; a feedback path from an output of said first memory to an input of said first register, for transferring said data from said first one of said data storage locations in said first memory to said first portion of said first address register, for concatenation with said x-bit words from said serial data stream to form an address for said second one of said data storage locations of said first memory; said second one of said data storage locations of said first memory having a start signal value stored therein, which is output when said first occurring portion of said characteristic virus pattern is detected by said digital filter; a second p-bit address register having a first portion with p-x bits and a second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream; said second address register coupled to said first memory, for receiving said start signal value from said first memory; second addressable memory having a plurality of data storage locations, each having a first portion with p-x bits, said second memory having a p-bit address input coupled an output of said second address register, said second memory configured with data stored in first and second ones of said data storage locations to represent a second digital filter for said second occurring virus pattern; a feedback path from an output of said second memory to an input of said second register, for transferring said data from said first one of said data storage locations in said second memory to said first portion of said second address register in response to said start signal value, for concatenation with said bit from said serial data stream to form an address for said second one of said data storage locations of said second memory; said second one of said data storage locations of said second memory having a virus pattern security alarm value stored therein, which is output when said second portion of said characteristic virus pattern is detected by said second digital filter; a counter coupled to said virus pattern security alarm value output, for counting occurrences of said second portion of said characteristic virus pattern in said data stream, and outputting a count value as an event counter; and control means, coupled to said counter, for receiving said event vector and in response thereto, performing security monitoring and control operations on a data communications medium providing said data stream.
Claim 47
Dependent Claim
573 words
An information collection architecture system for adaptive, active security monitoring of a serial stream of data having a characteristic virus pattern including a first occurring and a second occurring virus pattern portions, for performing security monitoring and control operations on a data communications medium providing said data stream, comprising: a first n-bit address register having a first portion with n-x bits and an second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream; first addressable memory having a plurality of data storage locations, each having a first portion with n-x bits, said first memory having an n-bit address input coupled an output of said first address register, said first memory configured with data stored in first and second ones of said data storage locations to represent a first digital filter for said first occurring virus pattern; a feedback path from an output of said first memory to an input of said first register, for transferring said data from said first one of said data storage locations in said first memory to said first portion of said first address register, for concatenation with said x-bit words from said serial data stream to form an address for said second one of said data storage locations of said first memory; said second one of said data storage locations of said first memory having a start signal value stored therein, which is output when said first occurring portion of said characteristic virus pattern is detected by said digital filter; a second p-bit address register having a first portion with p-x bits and a second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream; said second address register coupled to said first memory, for receiving said start signal value from said first memory; second addressable memory having a plurality of data storage locations, each having a first portion with p-x bits, said second memory having a p-bit address input coupled an output of said second address register, said second memory configured with data stored in first and second ones of said data storage locations to represent a second digital filter for said second occurring virus pattern; a feedback path from an output of said second memory to an input of said second register, for transferring said data from said first one of said data storage locations in said second memory to said first portion of said second address register in response to said start signal value, for concatenation with said bit from said serial data stream to form an address for said second one of said data storage locations of said second memory; said second one of said data storage locations of said second memory having a virus pattern security alarm value stored therein, which is output when said second portion of said characteristic virus pattern is detected by said second digital filter; a counter coupled to said virus pattern security alarm value output, for counting occurrences of said second portion of said characteristic virus pattern in said data stream, and outputting a count value as an event counter; and control means, coupled to said counter, for receiving said event vector and in response thereto, performing security monitoring and control operations on a data communications medium providing said data stream.
Claim 48
Dependent Claim
48 words
The system of claim 42, wherein said first address register and said first addressable memory are formed in a first integrated circuit chip; and said second address register and said second addressable memory are formed in a second integrated circuit chip, coupled to said first integrated circuit chip.
Claim 49
Dependent Claim
55 words
The system of claim 42, wherein said first address register and said first addressable memory are formed in a first multi-tasking memory partition of a data processor; and said second address register and said second addressable memory are formed in a second multi-tasking memory partition of said data processor, coupled to said first memory partition.
Claim 50
Dependent Claim
22 words
The system of claim 42, wherein said characteristic virus pattern is from a fiber optical distributed data interface (FDDI) data communications medium.
References Cited (Backward Citations)
US4227245A
Cited
US4458309A
Cited
US4459656A
Cited
US4521849A
Cited
JPS6153855A
Cited
US4805089A
Cited
US4779194A
Cited
US5062055A
Cited
US4980824A
Cited
US4944038A
Cited
US4851998A
Cited
US5051886A
Cited
US5084871A
Cited
US4905171A
Cited
US5072376A
Cited
US5067107A
Cited
US4939724A
Cited
US5035302A
Cited
US5077763A
Cited
US5079760A
Cited
US5319776A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1998-05-08 | 1998-11-07 | 1999-05-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2002-05-08 | 2002-11-07 | 2003-05-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2006-05-08 | 2006-11-07 | 2007-05-09 | $7700.00 | Window Closed / Lapsed |