US5935245A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for providing secure network communications
Assignee: HP Inc
•
Filing: 1997-04-29
•
Granted: 1999-08-10
•
Expires: 2017-04-29
Abstract
Abstract A data pattern enforcer provides secure network communications at an adaptor layer by comparing transmitted and received packets to a set of rules to verify that said packets are appropriately being transmitted or received. The data pattern enforcer prevents application or other software with access to an adaptor on a network from using the adaptor for packet sniffing or spoofing. In a specific embodiment, the data pattern enforcer verifies packets at the layer 2 adaptor level using a value bit vector (which may be alterable or may be preset to a value, including to zero), a count value, and a mask to compare to data found in packets.
Inventors
- 👤 William P. Sherer
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 14:05
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/14; H04L63/1441; H04L63/1475; H04L12/00; H04L12/28; H04L12/40; H04L12/40006; H04L12/40032
Claims Analysis
Total Claims: 30
Claim 1
Independent Claim
98 words
A method for preventing completed reception of an unauthorized packet by a network adaptor comprising: beginning to receive a packet from a communication channel; using a count value and a value bit vector (VBV) to compare data in said packet at said count value to said value bit vector; completing reception of said packet if said compare indicates that data in said packet matches said value bit vector; and aborting reception of said packet without passing said packet to higher layer software if said compare indicates that data in said packet does not match said value bit vector.
Claim 2
Independent Claim
98 words
A method for preventing completed reception of an unauthorized packet by a network adaptor comprising: beginning to receive a packet from a communication channel; using a count value and a value bit vector (VBV) to compare data in said packet at said count value to said value bit vector; completing reception of said packet if said compare indicates that data in said packet matches said value bit vector; and aborting reception of said packet without passing said packet to higher layer software if said compare indicates that data in said packet does not match said value bit vector.
Claim 3
Dependent Claim
32 words
The method according to claim 1 further comprising: using a don't care bit vector (DCBV) to indicate that certain bits in said VBV should not be compared to bits in said packet.
Claim 4
Dependent Claim
22 words
The method according to claim 2 wherein said count value is a non-alterable value and may be implicit in said compare function.
Claim 5
Dependent Claim
33 words
The method according to claim 1 wherein said compare takes place at a data link layer protocol and said packets are never passed up to a higher layer protocol if said compare fails.
Claim 6
Dependent Claim
20 words
The method according to claim 4 wherein said count value indicates data in a layer 3 address of said packet.
Claim 7
Dependent Claim
17 words
The method according to claim 3 wherein said data comprise a security field included in said packet.
Claim 8
Dependent Claim
16 words
The method according to claim 1 wherein said count value indicates data in a packet header.
Claim 9
Dependent Claim
20 words
The method according to claim 7 wherein said count value indicates data in a layer 2 address of said packet.
Claim 10
Dependent Claim
22 words
The method according to claim 1 wherein said count value is a non-alterable value and may be implicit in said compare function.
Claim 11
Independent Claim
100 words
A method for preventing completed transmission of an unauthorized packet by an adaptor card comprising: receiving a packet to transmit from a higher layer protocol: beginning to transmit a packet on a communication channel; using a count value and a value bit vector (VBV) to compare data in said packet at said count value to said value bit vector; if said compare indicates that data in said packet matches said value bit vector, completing transmission of said packet; and if said compare indicates that data in said packet does not match said value bit vector, aborting transmission of said packet.
Claim 12
Independent Claim
100 words
A method for preventing completed transmission of an unauthorized packet by an adaptor card comprising: receiving a packet to transmit from a higher layer protocol: beginning to transmit a packet on a communication channel; using a count value and a value bit vector (VBV) to compare data in said packet at said count value to said value bit vector; if said compare indicates that data in said packet matches said value bit vector, completing transmission of said packet; and if said compare indicates that data in said packet does not match said value bit vector, aborting transmission of said packet.
Claim 13
Dependent Claim
32 words
The method according to claim 10 further comprising: using a don't care bit vector (DCBV) to indicate that certain bits in said VBV should not be compared to bits in said packet.
Claim 14
Dependent Claim
16 words
The method according to claim 10 wherein said compare takes place at a data link layer.
Claim 15
Dependent Claim
16 words
The method according to claim 10 wherein said count value indicates data in a packet header.
Claim 16
Dependent Claim
20 words
The method according to claim 13 wherein said count value indicates data in a layer 2 address of said packet.
Claim 17
Dependent Claim
17 words
The method according to claim 13 wherein said data comprises a layer 3 address of said packet.
Claim 18
Dependent Claim
17 words
The method according to claim 13 wherein said data comprises a security field included in said packet.
Claim 19
Independent Claim
73 words
A method for preventing completed reception of an unauthorized packet by a network adaptor comprising: beginning to receive a packet from a communication channel; applying a rule to said packet at a packet reception layer; completing reception of said packet if said rule indicates that said packet is valid; and aborting reception of said packet without passing said packet to higher layer software if said rule indicates that said packet is not valid.
Claim 20
Independent Claim
73 words
A method for preventing completed reception of an unauthorized packet by a network adaptor comprising: beginning to receive a packet from a communication channel; applying a rule to said packet at a packet reception layer; completing reception of said packet if said rule indicates that said packet is valid; and aborting reception of said packet without passing said packet to higher layer software if said rule indicates that said packet is not valid.
Claim 21
Independent Claim
66 words
A method for preventing completed transmission of an unauthorized packet by an adaptor card comprising: receiving a packet to transmit from a higher layer protocol; applying a rule to said packet at a packet transmission layer; completing transmission of said packet if said rule indicates that said packet is valid; and aborting transmission of said packet if said rule indicates that said packet is not valid.
Claim 22
Independent Claim
66 words
A method for preventing completed transmission of an unauthorized packet by an adaptor card comprising: receiving a packet to transmit from a higher layer protocol; applying a rule to said packet at a packet transmission layer; completing transmission of said packet if said rule indicates that said packet is valid; and aborting transmission of said packet if said rule indicates that said packet is not valid.
Claim 23
Dependent Claim
55 words
An adaptor driver for use in an end system comprising: an application interface for passing packets between a network and higher network layers; a set of adaptor layer packet verification rules; a data pattern enforcer for applying said rules to packets at the adaptor layer; and a network interface for communicating packets on a network.
Claim 24
Dependent Claim
55 words
An adaptor driver for use in an end system comprising: an application interface for passing packets between a network and higher network layers; a set of adaptor layer packet verification rules; a data pattern enforcer for applying said rules to packets at the adaptor layer; and a network interface for communicating packets on a network.
Claim 25
Independent Claim
95 words
A method for preventing completed reception of an unauthorized packet by a network adaptor comprising: beginning to receive a packet from a communication channel; using a count value and a value bit vector to apply a simple validation rule to packet values in said packet at said count value; completing reception of said packet if said simple validation rule indicates that data in said packet is valid; and aborting reception of said packet without passing said packet to higher layer protocols if said simple validation rule indicates that data in said packet is not valid.
Claim 26
Independent Claim
95 words
A method for preventing completed reception of an unauthorized packet by a network adaptor comprising: beginning to receive a packet from a communication channel; using a count value and a value bit vector to apply a simple validation rule to packet values in said packet at said count value; completing reception of said packet if said simple validation rule indicates that data in said packet is valid; and aborting reception of said packet without passing said packet to higher layer protocols if said simple validation rule indicates that data in said packet is not valid.
Claim 27
Dependent Claim
35 words
The method according to claim 20 wherein said simple validation rule takes place at a data link layer protocol and said packets are never passed up to a higher layer protocol if said rule fails.
Claim 28
Dependent Claim
17 words
The method according to claim 20 wherein said count value indicates packet values in a packet header.
Claim 29
Dependent Claim
18 words
The method according to claim 20 wherein said packet values comprise a security field included in said packet.
Claim 30
Dependent Claim
24 words
The method according to claim 20 wherein said count value is a preset, non-alterable value and may be implicit in said simple validation rules.
References Cited (Backward Citations)
WO1989008887A1
Cited
US5594869A
Cited
EP0658837A2
Cited
EP0668680A1
Cited
US5752003A
Cited
US5796942A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-08-09 | 2003-02-08 | 2003-08-10 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-08-09 | 2007-02-08 | 2007-08-10 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-08-09 | 2011-02-08 | 2011-08-10 | $7700.00 | Window Closed / Lapsed |