US5798706A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Detecting unauthorized network communication
Assignee: Axent Technologies 1 Inc
•
Filing: 1996-06-18
•
Granted: 1998-08-25
•
Expires: 2016-06-18
Abstract
Abstract Back door packet communication between a workstation on a network and a device outside the network is identified by detecting packets that are associated with communication involving devices outside the network, and identifying packets, among those detected packets, that are being sent or received by a device that is not authorized for communication with devices outside the network.
Inventors
- 👤 Jeffrey A. Kraemer
- 👤 Alan J. Kirby
- 👤 David C. Waterman
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-29 00:33
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0236; H04L63/10; H04L63/102; H04L9/00; H04L9/40; H04L63/14; H04L63/1408
Claims Analysis
Total Claims: 25
Claim 1
Independent Claim
114 words
A method for use with devices that are coupled by a communication medium to form an internal packet network, at least one of the devices not being an authorized conduit for communication with external devices that are not part of the internal packet network, the method comprising observing packets passing on the medium, based on the observation, detecting packets that pass between the internal packet network and one of the external devices via one of the devices that is part of the internal network, and for detected packets associated with communication with the external device, determining if the one device via which the packets pass is an authorized conduit for communication with external devices.
Claim 2
Independent Claim
114 words
A method for use with devices that are coupled by a communication medium to form an internal packet network, at least one of the devices not being an authorized conduit for communication with external devices that are not part of the internal packet network, the method comprising observing packets passing on the medium, based on the observation, detecting packets that pass between the internal packet network and one of the external devices via one of the devices that is part of the internal network, and for detected packets associated with communication with the external device, determining if the one device via which the packets pass is an authorized conduit for communication with external devices.
Claim 3
Dependent Claim
48 words
The method of claim 1 in which the detecting comprises comparing address information in the packets with address information associated with devices that are part of the internal packet network to determine if the packet involves communication only between devices that are part of the internal packet network.
Claim 4
Dependent Claim
14 words
The method of claim 2 in which the address information comprises logical network addresses.
Claim 5
Dependent Claim
14 words
The method of claim 2 in which the logical network addresses comprise IP addresses.
Claim 6
Dependent Claim
26 words
The method of claim 2 further comprising storing the address information associated with devices that are part of the internal packet network in a look-up table.
Claim 7
Dependent Claim
16 words
The method of claim 1 in which the determining comprises examining hardware addresses in the packets.
Claim 8
Dependent Claim
21 words
The method of claim 6 in which the hardware addresses comprise unique hardware addresses of network interface cards in the devices.
Claim 9
Dependent Claim
29 words
The method of claim 1 further comprising comparing address information in the packets with address information associated with the devices that are authorized conduits for communication with external devices.
Claim 10
Dependent Claim
23 words
The method of claim 8 further comprising storing the address information associated with the devices that are authorized conduits in a look-up table.
Claim 11
Dependent Claim
36 words
The method of claim 1 in which at least one of the devices of the internal packet network is an authorized conduit for communication with external devices that are not part of the internal packet network.
Claim 12
Dependent Claim
14 words
The method of claim 1 further comprising storing packets temporarily in a look-ahead buffer.
Claim 13
Dependent Claim
13 words
The method of claim 1 further comprising reporting information about the non-authorized communication.
Claim 14
Independent Claim
86 words
A method for reducing back door packet communication between a device on a network that is not an authorized conduit for communication with external devices that are outside of the network and a device outside the network comprising detecting packets that pass between the network and the device outside the network via the device on the network, and identifying packets among the detected packets that are sent or received by the device on the network that is not authorized for communication with devices outside the network.
Claim 15
Independent Claim
86 words
A method for reducing back door packet communication between a device on a network that is not an authorized conduit for communication with external devices that are outside of the network and a device outside the network comprising detecting packets that pass between the network and the device outside the network via the device on the network, and identifying packets among the detected packets that are sent or received by the device on the network that is not authorized for communication with devices outside the network.
Claim 16
Dependent Claim
81 words
Apparatus for use in reducing packet communication between a device on a network that is not an authorized conduit for communication with devices outside the network and a device outside the network comprising a scanner connected to observe packets passing on the network, and an analyzer that determines if one of the packets includes address information indicating that communication is occurring with the device that is not an authorized conduit for communication with devices outside the network and the external device.
Claim 17
Dependent Claim
81 words
Apparatus for use in reducing packet communication between a device on a network that is not an authorized conduit for communication with devices outside the network and a device outside the network comprising a scanner connected to observe packets passing on the network, and an analyzer that determines if one of the packets includes address information indicating that communication is occurring with the device that is not an authorized conduit for communication with devices outside the network and the external device.
Claim 18
Independent Claim
103 words
A method for use with devices that are coupled by a communication medium to form an internal packet network, none of the devices being an authorized conduit for communication with external devices that are not part of the internal packet network, the method comprising observing network address information in packets passing on the medium, based on the observed network address information, detecting packets intended to pass from the internal packet network to the external device via one of the devices that is part of the internal packet network, and raising an alarm with respect to packets intended for communication with an external device.
Claim 19
Independent Claim
103 words
A method for use with devices that are coupled by a communication medium to form an internal packet network, none of the devices being an authorized conduit for communication with external devices that are not part of the internal packet network, the method comprising observing network address information in packets passing on the medium, based on the observed network address information, detecting packets intended to pass from the internal packet network to the external device via one of the devices that is part of the internal packet network, and raising an alarm with respect to packets intended for communication with an external device.
Claim 20
Dependent Claim
21 words
The method of claim 1 in which the determining comprises watching for packets indicating that a non-authorized device is advertising routes.
Claim 21
Dependent Claim
27 words
The method of claim 1 in which the determining comprises watching for redirect messages being sent by a non-authorized device to redirect traffic to an unauthorized gateway.
Claim 22
Independent Claim
115 words
A method for use with devices that are coupled by a communication medium to form an internal message network, at least one of the devices not being an authorized conduit for communication with external devices that are not part of the internal message network, the method comprising observing messages passing on the medium, based on the observation, detecting messages that pass between the internal packet network and one of the external devices via one of the devices that is part of the internal packet network, and for detected messages associated with communication with the external device, determining if the one device via which the packets pass is an authorized conduit for communication with external devices.
Claim 23
Independent Claim
115 words
A method for use with devices that are coupled by a communication medium to form an internal message network, at least one of the devices not being an authorized conduit for communication with external devices that are not part of the internal message network, the method comprising observing messages passing on the medium, based on the observation, detecting messages that pass between the internal packet network and one of the external devices via one of the devices that is part of the internal packet network, and for detected messages associated with communication with the external device, determining if the one device via which the packets pass is an authorized conduit for communication with external devices.
Claim 24
Independent Claim
172 words
A method for use with devices that are coupled by a communication medium to form an internal packet network, at least one of the devices not being an authorized conduit for communication with external devices that are not part of the internal packet network, the method comprising observing packets passing on the medium, based on the observation, detecting packets that pass between the internal packet network and one of the external devices via one of the devices that is part of the internal network by comparing the IP addresses of the packets with the IP addresses of devices on the internal packet network, for detected packets associated with communication with the external device, determining if the one device via which the packets pass is an authorized conduit for communication with external devices by comparing the hardware addresses of the packets with hardware addresses that correspond to devices that are authorized conduits, and for packets whose hardware addresses do not correspond to devices that are authorized conduits, reporting information about the non-authorized communication.
Claim 25
Independent Claim
172 words
A method for use with devices that are coupled by a communication medium to form an internal packet network, at least one of the devices not being an authorized conduit for communication with external devices that are not part of the internal packet network, the method comprising observing packets passing on the medium, based on the observation, detecting packets that pass between the internal packet network and one of the external devices via one of the devices that is part of the internal network by comparing the IP addresses of the packets with the IP addresses of devices on the internal packet network, for detected packets associated with communication with the external device, determining if the one device via which the packets pass is an authorized conduit for communication with external devices by comparing the hardware addresses of the packets with hardware addresses that correspond to devices that are authorized conduits, and for packets whose hardware addresses do not correspond to devices that are authorized conduits, reporting information about the non-authorized communication.
References Cited (Backward Citations)
US5537099A
Cited
US5414833A
Cited
US5606668A
Cited
US5557742A
Cited
US5479612A
Cited
US5623601A
Cited
US5550984A
Cited
US5581559A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-08-24 | 2002-02-23 | 2002-08-25 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-08-24 | 2006-02-23 | 2006-08-25 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-08-24 | 2010-02-23 | 2010-08-25 | $7700.00 | Window Closed / Lapsed |