Patent US5606668A successfully refreshed from Google Patents.
US5606668A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System for securing inbound and outbound data packet flow in a computer network
Assignee: Check Point Software Technologies Ltd
•
Filing: 1993-12-15
•
Granted: 1997-02-25
•
Expires: 2013-12-15
Abstract
Abstract A filter module allows controlling network security by specifying security rules for traffic in the network and accepting or dropping communication packets according to these security rules. A set of security rules are defined in a high level form and are translated into a packet filter code. The packet filter code is loaded into packet filter modules located in strategic points in the network. Each packet transmitted or received at these locations is inspected by performing the instructions in the packet filter code. The result of the packet filter code operation decides whether to accept (pass) or reject (drop) the packet, disallowing the communication attempt.
Inventors
- 👤 Gil Shwed
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 13:23
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0263; H04L9/00; H04L9/40
Claims Analysis
Total Claims: 14
Claim 1
Independent Claim
164 words
A method of inspecting inbound and outbound data packets in a computer network, the inspection of said data packets occurring according to a security rule, the method comprising the steps of: a) generating a definition of each aspect or the computer network inspected by said security rule; b) generating said security rule in terms of said aspect definitions, said security rule controlling as least one of said aspects; c) converting said security rule into a set of packet filter language instructions for controlling the operation of a packet filtering module which inspects said data packets; d) providing a packet filter module coupled to said computer network for inspecting said data packets in accordance with said security rule, said packet filter module implementing a virtual packet filtering machine; and e) said packet filter module executing said packet filter language instructions for operating said virtual packet filtering machine to either accept or reject the passage of said data packets into and out of said computer network.
Claim 2
Independent Claim
164 words
A method of inspecting inbound and outbound data packets in a computer network, the inspection of said data packets occurring according to a security rule, the method comprising the steps of: a) generating a definition of each aspect or the computer network inspected by said security rule; b) generating said security rule in terms of said aspect definitions, said security rule controlling as least one of said aspects; c) converting said security rule into a set of packet filter language instructions for controlling the operation of a packet filtering module which inspects said data packets; d) providing a packet filter module coupled to said computer network for inspecting said data packets in accordance with said security rule, said packet filter module implementing a virtual packet filtering machine; and e) said packet filter module executing said packet filter language instructions for operating said virtual packet filtering machine to either accept or reject the passage of said data packets into and out of said computer network.
Claim 3
Dependent Claim
12 words
The method according to claim 1 wherein said aspects include network objects.
Claim 4
Dependent Claim
12 words
The method according to claim 1 wherein said aspects include network services.
Claim 5
Dependent Claim
12 words
The method according to claim 2 wherein said aspects include network services.
Claim 6
Dependent Claim
16 words
The method according to claim 4 wherein said object definitions include the address of said object.
Claim 7
Dependent Claim
36 words
The method according to claim 1 wherein the filter language instructions of step c) are in the form of script and further comprising a compiler to compile said script into said instructions executed in step e).
Claim 8
Dependent Claim
27 words
The method according to claim 1 wherein in said generating steps a) and b) the aspects of the network and of the security rule are defined graphically.
Claim 9
Dependent Claim
199 words
In a security system for inspecting inbound and outbound data packets in a computer network, said security system inspecting said data packets in said computer network according to a security rule, where each aspect of said computer network inspected by said security rule has been previously defined, said security rule previously defined in terms of said aspects and converted into packet filter language instructions, a method for operating said security system comprising the steps of: a) providing a packet filter module coupled to said computer network in at least one entity of said computer network to be controlled by said security rule, said packet filter module emulating a virtual packet filtering machine inspecting said data packets passing into and out of said computer network; b) said packet filter module reading and executing said packet filter language instructions for performing packet filtering operations; c) storing the results obtained in said step of reading and executing said packet filter language instructions in a storage device; and d) said packet filter module utilizing said stored results, from previous inspections, for operating said packet filter module to accept or reject the passage of said data packet into and out of said computer network.
Claim 10
Dependent Claim
199 words
In a security system for inspecting inbound and outbound data packets in a computer network, said security system inspecting said data packets in said computer network according to a security rule, where each aspect of said computer network inspected by said security rule has been previously defined, said security rule previously defined in terms of said aspects and converted into packet filter language instructions, a method for operating said security system comprising the steps of: a) providing a packet filter module coupled to said computer network in at least one entity of said computer network to be controlled by said security rule, said packet filter module emulating a virtual packet filtering machine inspecting said data packets passing into and out of said computer network; b) said packet filter module reading and executing said packet filter language instructions for performing packet filtering operations; c) storing the results obtained in said step of reading and executing said packet filter language instructions in a storage device; and d) said packet filter module utilizing said stored results, from previous inspections, for operating said packet filter module to accept or reject the passage of said data packet into and out of said computer network.
Claim 11
Dependent Claim
12 words
The method according to claim 8 wherein said aspects include network objects.
Claim 12
Dependent Claim
12 words
The method according to claim 8 wherein said aspects include network services.
Claim 13
Dependent Claim
12 words
The method according to claim 9 wherein said aspects include network services.
Claim 14
Dependent Claim
16 words
The method according to claim 11 wherein said object definitions include the address of said object.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2000-02-25 | 2000-08-26 | 2001-02-25 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2004-02-25 | 2004-08-26 | 2005-02-25 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2008-02-25 | 2008-08-26 | 2009-02-25 | $7700.00 | Window Closed / Lapsed |