US5802178A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Stand alone device for providing security within computer networks
Assignee: Round Rock Research LLC
•
Filing: 1996-07-30
•
Granted: 1998-09-01
•
Expires: 2016-07-30
Abstract
Abstract A multi-level security device is disclosed for providing security between a user and at least one computer network, wherein the user is selected from the group consisting of a host computer and at least a second network. A secure network interface Unit (SNIU) that operates at a user layer communications protocol, which communicates with other like SNIU devices by establishing an association at a session layer of a communication stack in order to create a global security perimeter for end-to-end communications. The SNIU includes a host/network interface for receiving messages sent between the user and the at least one network, which is operative to convert the received messages to and from a format utilized by the at least one network. A message parser for determining whether the association already exists with another SNIU device. A session manager coupled to the interface for identifying and verifying the user requesting access to the network. The session manager also for transmitting the messages received from the user when the message parser determines the association already exists. An association manager coupled to the interface for establishing an association with other like SNIU devices when the message parser determines the association does not exist.
Inventors
- 👤 James M. Holden
- 👤 Stephen E. Levin
- 👤 James O. Nickel
- 👤 Edwin H. Wrench, Jr.
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-27 21:15
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0209; H04L63/0218; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/34; G06F21/50; G06F21/57; H04L63/0272; H04L63/04; H04L63/0428; H04L63/12; H04L63/16; H04L63/162; G06F2211/00; G06F2211/005
Claims Analysis
Total Claims: 21
Claim 1
Independent Claim
242 words
A multi-level security device for providing security between a user and at least one computer network, wherein the user is selected from the group consisting of a host computer and at least a second network, comprising: a secure network interface Unit (SNIU) that operates at a user layer communications protocol, said SNIU communicates with other like SNIU devices by establishing an association at a session layer of a communication stack in order to provide secure end-to-end communications, comprising: a host/network interface for receiving messages sent between said user and said at least one network, said interface operative to convert said received messages to and from a format utilized by said at least one network; a message parser for receiving said messages from said host/network interface, determining whether said association already exists with another SNIU device and providing a signal indicative of said determination; a session manager coupled to said interface for identifying and verifying said user requesting access to said network, said session manager also responsive to said signal from said message parser for transmitting said messages received from said user when said message parser determines said association already exists; and an association manager coupled to said interface and responsive to said signal from said message parser for establishing an association with other like SNIU devices when said message parser determines said association does not exist, wherein said message parser stores said messages in a wait queue until said association is established.
Claim 2
Dependent Claim
242 words
A multi-level security device for providing security between a user and at least one computer network, wherein the user is selected from the group consisting of a host computer and at least a second network, comprising: a secure network interface Unit (SNIU) that operates at a user layer communications protocol, said SNIU communicates with other like SNIU devices by establishing an association at a session layer of a communication stack in order to provide secure end-to-end communications, comprising: a host/network interface for receiving messages sent between said user and said at least one network, said interface operative to convert said received messages to and from a format utilized by said at least one network; a message parser for receiving said messages from said host/network interface, determining whether said association already exists with another SNIU device and providing a signal indicative of said determination; a session manager coupled to said interface for identifying and verifying said user requesting access to said network, said session manager also responsive to said signal from said message parser for transmitting said messages received from said user when said message parser determines said association already exists; and an association manager coupled to said interface and responsive to said signal from said message parser for establishing an association with other like SNIU devices when said message parser determines said association does not exist, wherein said message parser stores said messages in a wait queue until said association is established.
Claim 3
Dependent Claim
26 words
The device of claim 1, wherein said association manager generates an ICMP Echo request message in order to establish an association with other like SNIU devices.
Claim 4
Dependent Claim
15 words
The device of claim 2, wherein said ICMP Echo request includes the user's security level.
Claim 5
Dependent Claim
25 words
The device of claim 1, wherein said association manager generates a ICMP Echo reply in order to grant an association with other like SNIU devices.
Claim 6
Dependent Claim
18 words
The device of claim 1, which further includes a card reader configured to perform integrity and authenticating functions.
Claim 7
Dependent Claim
54 words
The device of claim 1, wherein said session manager protects the security communications between said computer device and said network by implementing a security policy selected from a group consisting of discretionary access control, mandatory access control, object reuse, labeling, denial of service detection, data type integrity, cascading control and covert channel use detection.
Claim 8
Dependent Claim
28 words
The device of claim 1, wherein said SNIU further includes means for performing a defined trusted session layer protocol (TSP), said TSP constituting said user layer communications protocol.
Claim 9
Dependent Claim
33 words
The device of claim 1, wherein said SNIUs during said association perform a function selected from the group consisting of authenticating each other, exchanging security parameters and establishing trusted sessions for further communications.
Claim 10
Dependent Claim
22 words
The device of claim 1, wherein said host/network interface also processes Address Resolution Protocol (ARP) and Reverse Address Resolution Protocol (RARP) messages.
Claim 11
Dependent Claim
30 words
The device of claim 1, wherein said SNIU further includes a scheduler coupled between said host/network and said message parser for controlling the flow of said data within said SNIU.
Claim 12
Dependent Claim
33 words
The device of claim 1, wherein said SNIU further includes an audit manager coupled to said association manager for generating audit event messages when a message is received with an invalid authorization code.
Claim 13
Independent Claim
179 words
A method of providing a multi-level network security system for a user and at least one computer network, wherein said user is selected from the group consisting of a host computer and at least a second network, comprising: placing a secure network interface Unit (SNIU) that operates at a user layer communications protocol, said SNIU communicates with other like SNIU devices by establishing an association at a session layer of a communication stack in order to provide secure end-to-end communications, said SNIU performing a plurality of security functions including: receiving messages sent between said user and said at least one network; converting said received messages to and from a format utilized by said at least one network; identifying and verifying said user requesting access to said network; determining whether said association already exists with another SNIU device; transmitting said messages received from said user when said association already exists; temporarily storing said received messages from said computer device when said association does not exist; and establishing an association with other like SNIU devices when said association does not exist.
Claim 14
Independent Claim
179 words
A method of providing a multi-level network security system for a user and at least one computer network, wherein said user is selected from the group consisting of a host computer and at least a second network, comprising: placing a secure network interface Unit (SNIU) that operates at a user layer communications protocol, said SNIU communicates with other like SNIU devices by establishing an association at a session layer of a communication stack in order to provide secure end-to-end communications, said SNIU performing a plurality of security functions including: receiving messages sent between said user and said at least one network; converting said received messages to and from a format utilized by said at least one network; identifying and verifying said user requesting access to said network; determining whether said association already exists with another SNIU device; transmitting said messages received from said user when said association already exists; temporarily storing said received messages from said computer device when said association does not exist; and establishing an association with other like SNIU devices when said association does not exist.
Claim 15
Dependent Claim
18 words
The method of claim 12, which further includes encrypting outgoing messages and decrypting incoming messages of said SNIU.
Claim 16
Dependent Claim
23 words
The method of claim 13, which further includes generating and writing cryptographic residues for outgoing messages and validating cryptographic residues for incoming messages.
Claim 17
Dependent Claim
53 words
The method of claim 12, wherein said SNIU protects the security communications between said computer device and said network by implementing a security policy selected from a group consisting of discretionary access control, mandatory access control, object reuse, labeling, denial of service detection, data type integrity, cascading control and covert channel use detection.
Claim 18
Dependent Claim
12 words
The method of claim 12, which further includes generating an audit trail.
Claim 19
Dependent Claim
76 words
The method of claim 12, wherein said association is established by said SNIU: storing a datagram including information received from the user; transmitting an ICMP Echo request message in order to request said association with other like SNIU devices; waiting to receive an ICMP Echo reply message from other like SNIU devices in order to grant said association; retrieving said stored datagram when said SNIU receives said ICMP Echo reply message; and transmitting said retrieved datagram.
Claim 20
Dependent Claim
15 words
The method of claim 18, wherein said ICMP Echo request includes the user's security level.
Claim 21
Dependent Claim
39 words
The method of claim 12, which further includes transmitting an ARP Request message including said SNIU's hardware and IP address, and IP address of other like SNIU devices in order to locate other like SNIU devices on the network.
References Cited (Backward Citations)
US5228083A
Cited
US5602920A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-08-31 | 2002-03-02 | 2002-09-01 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-08-31 | 2006-03-02 | 2006-09-01 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-08-31 | 2010-03-02 | 2010-09-01 | $7700.00 | Window Closed / Lapsed |