US5548649A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Network security bridge and associated method
Assignee: Iowa State University Research Foundation Inc
•
Filing: 1995-03-28
•
Granted: 1996-08-20
•
Expires: 2015-03-28
Abstract
Abstract A network local security bridge and corresponding method for bridging a first side of a network and a second side of the network. The first side includes local secure zone host devices within a local secure zone established by the network local security bridge. The second side includes remote secure zone host devices within remote secure zones established by network remote security bridges. The network local security bridge processes a first side data packet received from the first side of the network and a second side data packet received from the second side of the network. In doing so, the network local security bridge encrypts the data frame of the first side data packet when its source and destination addresses respectively specify one of the local secure zone host devices and one of the remote secure zone host devices and leaves the data frame of the first side data packet unchanged when its source and destination addresses respectively specify one of the local secure zone host devices and one of the unsecure host devices. In addition, the network local security bridge decrypts the data frame of the second side data packet when its source and destination addresses respectively specify one of the remote secure zone host devices and one of the local secure zone host devices and leaves the data frame of the second side data packet unchanged when its source and destination addresses respectively specify one of the unsecure host devices and one of the local secure zone host devices. It then transmits the processed first side data packet to the second side and the processed second side data packet to the first side.
Inventors
- 👤 Douglas W. Jacobson
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-04 17:04
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L63/0428; H04L63/0464; H04L63/08
Claims Analysis
Total Claims: 16
Claim 1
Independent Claim
291 words
A network local security bridge that bridges a first side of a network and a second side of the network, the first side of the network including local secure zone host devices within a local secure zone established by the network local security bridge, the second side of the network including network remote security bridges that each establish a remote secure zone and remote secure zone host devices within the remote secure zones, the network local security bridge comprising: a first interface controller to receive from the first side of the network a first data packet that contains a source address, a destination address, and a data frame; a second interface controller to receive from the second side of the network a second data packet that contains a source address, a destination address, and a data frame; a data packet processor coupled to the first and second interface controllers to process the first and second data packets by encrypting the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, and by decrypting the data frame of the received second data packet when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices; the second interface controller transmitting the processed first data packet to the second side of the network; and the first interface controller transmitting the processed second data packet to the first side of the network.
Claim 2
Dependent Claim
291 words
A network local security bridge that bridges a first side of a network and a second side of the network, the first side of the network including local secure zone host devices within a local secure zone established by the network local security bridge, the second side of the network including network remote security bridges that each establish a remote secure zone and remote secure zone host devices within the remote secure zones, the network local security bridge comprising: a first interface controller to receive from the first side of the network a first data packet that contains a source address, a destination address, and a data frame; a second interface controller to receive from the second side of the network a second data packet that contains a source address, a destination address, and a data frame; a data packet processor coupled to the first and second interface controllers to process the first and second data packets by encrypting the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, and by decrypting the data frame of the received second data packet when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices; the second interface controller transmitting the processed first data packet to the second side of the network; and the first interface controller transmitting the processed second data packet to the first side of the network.
Claim 3
Dependent Claim
297 words
A network local security bridge as recited in claim 1 wherein the data packet processor includes: a data library containing, for each remote secure zone host device, information identifying the network remote security bridge that establishes the remote secure zone within which it is contained, and containing keys that each correspond to one of the network remote security bridges; a data packet forwarder to select one of the keys from the library for use in encrypting when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, the key selected for use in encrypting corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the destination address of the received first data packet, and to select one of the keys from the library for use in decrypting when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices, the key selected for use in decrypting corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the source address of the received second data packet; and an encryptor/decryptor to encrypt the data frame of the first side data packet with the key selected for use in encrypting, and to decrypt the data frame of the second data packet with the key selected for use in decrypting.
Claim 4
Dependent Claim
283 words
A network local security bridge as recited in claim 1 wherein the data packet processor includes: a data library containing, for each remote secure zone host device, information identifying the network remote security bridge that establishes the remote secure zone within which it is contained, and containing, for each network remote security bridge, a corresponding destination key and a corresponding source key; a data packet forwarder to select one of the destination keys from the library when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, the selected destination key corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the destination address of the received first data packet, and to select one of the source keys from the library when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices, the selected source key corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the source address of the received second data packet; and an encryptor/decryptor to encrypt the data frame of the received first data packet with the selected destination key, and to decrypt the data frame of the received second data packet with the selected source key.
Claim 5
Dependent Claim
391 words
A network local security bridge that bridges a first side of a network and a second side of the network, the first side of the network including local secure zone host devices within a local secure zone established by the network local security bridge, the second side of the network including unsecure host devices, network remote security bridges that each establish a remote secure zone, and remote secure zone host devices within the remote secure zones, the network local security bridge comprising: a first interface controller to receive from the first side of the network a first data packet that contains a source address, a destination address, and a data frame; a second interface controller to receive from the second side of the network a second data packet that contains a source address, a destination address, and a data frame; a data packet processor coupled to the first and second interfaces to process the received first and second side data packets by encrypting the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, by leaving unchanged the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the unsecure host devices, by decrypting the data frame of the received second data packet when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices, and by leaving unchanged the data frame of the received second data packet when the source address of the received second data packet specifies one of the unsecure host devices and the destination address of the received second data packet specifies one of the local secure zone host devices; the second interface controller transmitting the processed first data packet to the second side of the network; and the first interface controller transmitting the processed second data packet to the first side of the network.
Claim 6
Dependent Claim
391 words
A network local security bridge that bridges a first side of a network and a second side of the network, the first side of the network including local secure zone host devices within a local secure zone established by the network local security bridge, the second side of the network including unsecure host devices, network remote security bridges that each establish a remote secure zone, and remote secure zone host devices within the remote secure zones, the network local security bridge comprising: a first interface controller to receive from the first side of the network a first data packet that contains a source address, a destination address, and a data frame; a second interface controller to receive from the second side of the network a second data packet that contains a source address, a destination address, and a data frame; a data packet processor coupled to the first and second interfaces to process the received first and second side data packets by encrypting the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, by leaving unchanged the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the unsecure host devices, by decrypting the data frame of the received second data packet when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices, and by leaving unchanged the data frame of the received second data packet when the source address of the received second data packet specifies one of the unsecure host devices and the destination address of the received second data packet specifies one of the local secure zone host devices; the second interface controller transmitting the processed first data packet to the second side of the network; and the first interface controller transmitting the processed second data packet to the first side of the network.
Claim 7
Dependent Claim
300 words
A network local security bridge as recited in claim 4 wherein the data packet processor includes: a data library containing, for each remote secure zone host device, information identifying the network remote security bridge that establishes the remote secure zone within which it is contained, and containing keys that each correspond to one of the network remote security bridges; a data packet forwarder to select one of the keys from the library for use in encrypting when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, the key selected for use in encrypting corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the destination address of the received first data packet, and to select one of the keys from the library for use in decrypting when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices, the key selected for use in decrypting corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device having the predefined address specified by the source address of the received second data packet; and an encryptor/decryptor to encrypt the data frame of the first data packet with the key selected for use in encrypting, and to decrypt the data frame of the second data packet with the key selected for use in decrypting.
Claim 8
Dependent Claim
283 words
A network local security bridge as recited in claim 4 wherein the data packet processor includes: a data library containing, for each remote secure zone host device, information identifying the network remote security bridge that establishes the remote secure zone within which it is contained, and containing for each network remote security bridge, a corresponding destination key and a corresponding source key; a data packet forwarder to select one of the destination keys from the library when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, the selected destination key corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the destination address of the received first data packet, and to select one of the source keys from the library when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices, the selected source key corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the source address of the received second data packet; and an encryptor/decryptor to encrypt the data frame of the received first data packet with the selected destination key, and to decrypt the data frame of the received second data packet with the selected source key.
Claim 9
Independent Claim
251 words
A method of bridging a first side of a network and a second side of the network to establish a local secure zone, the first side of the network including local secure zone host devices within the local secure zone, the second side of the network including network remote security bridges that each establish a remote secure zone and remote secure zone host devices within the remote secure zones, the method comprising the steps of: receiving from the first of the network a first data packet that contains a source address, a destination address, and a data frame; receiving from the second of the network a second data packet that contains a source address, a destination address, and a data frame; processing the received first and second data packets including the steps of: encrypting the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices; and decrypting the data frame of the received second data packet when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices; transmitting the processed first data packet to the second side; and transmitting the processed second data packet to the first side.
Claim 10
Independent Claim
251 words
A method of bridging a first side of a network and a second side of the network to establish a local secure zone, the first side of the network including local secure zone host devices within the local secure zone, the second side of the network including network remote security bridges that each establish a remote secure zone and remote secure zone host devices within the remote secure zones, the method comprising the steps of: receiving from the first of the network a first data packet that contains a source address, a destination address, and a data frame; receiving from the second of the network a second data packet that contains a source address, a destination address, and a data frame; processing the received first and second data packets including the steps of: encrypting the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices; and decrypting the data frame of the received second data packet when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices; transmitting the processed first data packet to the second side; and transmitting the processed second data packet to the first side.
Claim 11
Dependent Claim
291 words
A method as recited in claim 7 further comprising the steps of: providing a data library containing, for each remote secure zone host device, information identifying the network remote security bridge that establishes the remote secure zone within which it is contained, and keys that each correspond to one of the network remote security bridges; the processing step further including the steps of: selecting one of the keys from the library for encrypting when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, the key selected for encrypting corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the destination address of the received first data packet; and selecting one of the keys from the library for decrypting when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices, the key selected for decrypting corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the source address of the received second data packet; the encrypting step including the step of encrypting the data frame of the first data packet with the key selected for encrypting; and the decrypting step including the step of decrypting the data frame of the second data packet with the key selected for decrypting.
Claim 12
Dependent Claim
290 words
A method as recited in claim 7 further comprising the steps of: providing a data library containing., for each remote secure zone host device, information identifying the network remote security bridge that establishes the remote secure zone within which it is contained, and containing, for each network remote security bridge, a corresponding destination key and a corresponding source key; the processing step further including the steps of: selecting one of the destination keys from the library when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, the selected destination key corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the destination address of the received first data packet; and selecting one of the source keys from the library when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices, the selected source key corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the source address of the received second data packet; and the encrypting step including the step of encrypting the data frame of the first data packet with the selected destination key; and the decrypting step including the step of decrypting the data frame of the second data packet with the selected source key.
Claim 13
Independent Claim
351 words
A method of bridging a first side of a network and a second side of the network to establish a local secure zone, the first side of the network including local secure zone host devices within the local secure zone, the second side of the network including unsecure host devices, network remote security bridges that each establish a remote secure zone, and remote secure zone host devices within the remote secure zones, the method comprising the steps of: receiving from the first side of the network a first data packet that contains a source address, a destination address, and a data frame; receiving from the second side of the network a second data packet that contains a source address, a destination address, and a data frame; processing the received first and second data packets including the steps of: encrypting the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices; and leaving unchanged the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the unsecure host devices; decrypting the data frame of the received second data packet when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices; and leaving unchanged the data frame of the received second data packet when the source address of the received second data packet specifies one of the unsecure host devices and the destination address of the received second data packet specifies one of the local secure zone host devices transmitting the processed first data packet to the second side; and transmitting the processed second data packet to the first side.
Claim 14
Independent Claim
351 words
A method of bridging a first side of a network and a second side of the network to establish a local secure zone, the first side of the network including local secure zone host devices within the local secure zone, the second side of the network including unsecure host devices, network remote security bridges that each establish a remote secure zone, and remote secure zone host devices within the remote secure zones, the method comprising the steps of: receiving from the first side of the network a first data packet that contains a source address, a destination address, and a data frame; receiving from the second side of the network a second data packet that contains a source address, a destination address, and a data frame; processing the received first and second data packets including the steps of: encrypting the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices; and leaving unchanged the data frame of the received first data packet when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the unsecure host devices; decrypting the data frame of the received second data packet when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices; and leaving unchanged the data frame of the received second data packet when the source address of the received second data packet specifies one of the unsecure host devices and the destination address of the received second data packet specifies one of the local secure zone host devices transmitting the processed first data packet to the second side; and transmitting the processed second data packet to the first side.
Claim 15
Dependent Claim
304 words
A method as recited in claim 10 further comprising the steps of: providing a data library containing, for each remote secure zone host device, information identifying the network remote security bridge that establishes the remote secure zone within which it is contained, and containing keys that each correspond to one of the network remote security bridges; the processing step including the steps of: selecting one of the keys from the library for use in encrypting when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, the key selected for use in encrypting corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the destination address of the received first data packet; and selecting one of the keys from the library for use in decrypting when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices, the key selected for use in decrypting corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the source address of the received second data packet; and the encrypting step including the step of encrypting the data frame of the first data packet with the key selected for use in encrypting; and the decrypting step including the step of decrypting the data frame of the second data packet with the key selected for use in decrypting.
Claim 16
Dependent Claim
288 words
A method as recited in claim 10 further comprising the steps of: providing a library containing, for each remote secure zone host device, information identifying the network remote security bridge that establishes the remote secure zone within which it is contained, and containing, for each network remote security bridge, a corresponding destination key and a corresponding source key; the processing step including the steps of: selecting one of the destination keys from the library when the source address of the received first data packet specifies one of the local secure zone host devices and the destination address of the received first data packet specifies one of the remote secure zone host devices, the selected destination key corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the destination address of the received first data packet; and selecting one of the source keys from the library when the source address of the received second data packet specifies one of the remote secure zone host devices and the destination address of the received second data packet specifies one of the local secure zone host devices, the selected source key corresponding to the network remote security bridge that according to the information in the library establishes the remote secure zone containing the remote secure zone host device specified by the source address of the received second data packet; and the encrypting step including the step of encrypting the data frame of the first data packet with the selected destination key; and the decrypting step including the step of decrypting the data frame of the second data packet with the selected source key.
References Cited (Backward Citations)
US4901348A
Cited
US4731841A
Cited
US4933971A
Cited
US5161192A
Cited
US5056140A
Cited
US5268962A
Cited
US5386471A
Cited
US5416842A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1999-08-20 | 2000-02-19 | 2000-08-20 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2003-08-20 | 2004-02-19 | 2004-08-20 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2007-08-20 | 2008-02-19 | 2008-08-20 | $7700.00 | Window Closed / Lapsed |