US5940591A — Apparatus and method for providing network securi…

Claim 1

Independent Claim 181 words

A multi-level network security apparatus for a computer network having at least one user coupled thereto, the at least one user selected from a group consisting of a host computer and a second untrusted network, comprising: a secure network interface unit (SNIU) having a first port for coupling to said at least one user and a second port for directly connecting to the computer network which operates at a user layer communications protocol, said SNIU providing security control by controlling access to the computer network at least one of the layers above the transport layer of the communications protocol, wherein the SNIU is implemented to create a global security perimeter for end-to-end communications and wherein the computer network may be individually secure or non-secure without compromising security of communications within said global security perimeter; and a security management architecture, including a security manager (SM) coupled to said SNIU for causing said SNIU to be initialized, operated and configured for protecting the security communications transmitted through said SNIU, said SM capable of implementing at least one of a plurality of security policies.

Claim 2

Dependent Claim 181 words

A multi-level network security apparatus for a computer network having at least one user coupled thereto, the at least one user selected from a group consisting of a host computer and a second untrusted network, comprising: a secure network interface unit (SNIU) having a first port for coupling to said at least one user and a second port for directly connecting to the computer network which operates at a user layer communications protocol, said SNIU providing security control by controlling access to the computer network at least one of the layers above the transport layer of the communications protocol, wherein the SNIU is implemented to create a global security perimeter for end-to-end communications and wherein the computer network may be individually secure or non-secure without compromising security of communications within said global security perimeter; and a security management architecture, including a security manager (SM) coupled to said SNIU for causing said SNIU to be initialized, operated and configured for protecting the security communications transmitted through said SNIU, said SM capable of implementing at least one of a plurality of security policies.

Claim 3

Dependent Claim 44 words

The network security apparatus according to claim 1, wherein said plurality of security policies is selected from the group consisting of discretionary access control, mandatory access control, object reuse, labeling, denial of service detection, data type integrity, cascading control and covert channel use detection.

Claim 4

Dependent Claim 38 words

The network security apparatus according to claim 1, said SNIU further comprising an association manager operable to establish and control a user session at a session layer of interconnection between the at least one user and the network.

Claim 5

Dependent Claim 38 words

The network security apparatus according to claim 3, said SNIU further comprising a dialog manager in communication with said association manager and said security manager for setting up, controlling, and terminating a data path established in said SNIU.

Claim 6

Dependent Claim 24 words

The network security apparatus according to claim 1, said SNIU further comprising a session manager for identifying a user requesting access to the network.

Claim 7

Dependent Claim 49 words

The network security apparatus according to claim 1, said SNIU further comprising an association manager which operates to establish and control a user session at a session layer of interconnection between the at least one user and the network if the at least one user is verified for access.

Claim 8

Dependent Claim 31 words

The network security apparatus according to claim 1, wherein said SNIU further comprises means for performing a defined trusted session layer protocol (TSP), said TSP constituting said user layer communications protocol.

Claim 9

Dependent Claim 26 words

The network security apparatus according to claim 1, wherein said SNIU is operable to prevent covert information flow within said global security perimeter for end-to-end communications.

Claim 10

Dependent Claim 22 words

The network security apparatus according to claim 1, wherein said SNIU includes a data sealer for validating data transmitted through said SNIU.

Claim 11

Dependent Claim 33 words

The network security apparatus according to claim 1, wherein functions of said SM comprise exchanging data and commands with said SNIU, performing initialization, configuration control, access control, sealer key management, and audit alarms.

Claim 12

Independent Claim 187 words

A method of providing multi-level network security for a computer network having at least one user coupled thereto, the at least one user selected from a group consisting of a host computer and at least a second network, said method comprising steps of: coupling a secure network interface unit (SNIU) to said at least one user and directly to the computer network which operates at a user layer communications protocol, said SNIU providing security control by controlling access to the computer network at at least one of the layers above the transport layer of the communications protocol, whereby the SNIU is implemented to create a global security perimeter for end-to-end communications and wherein the computer network may be individually secure or non-secure without compromising security of communications within said global security perimeter; and, performing security management utilizing a security manager (SM) connected to said SNIU for causing said SNIU to be operated and configured for protecting the security communications transmitted through said SNIU between the at least one user and the computer network, said SM capable of implementing at least one of a plurality of security policies.

Claim 13

Independent Claim 187 words

A method of providing multi-level network security for a computer network having at least one user coupled thereto, the at least one user selected from a group consisting of a host computer and at least a second network, said method comprising steps of: coupling a secure network interface unit (SNIU) to said at least one user and directly to the computer network which operates at a user layer communications protocol, said SNIU providing security control by controlling access to the computer network at at least one of the layers above the transport layer of the communications protocol, whereby the SNIU is implemented to create a global security perimeter for end-to-end communications and wherein the computer network may be individually secure or non-secure without compromising security of communications within said global security perimeter; and, performing security management utilizing a security manager (SM) connected to said SNIU for causing said SNIU to be operated and configured for protecting the security communications transmitted through said SNIU between the at least one user and the computer network, said SM capable of implementing at least one of a plurality of security policies.

Claim 14

Dependent Claim 46 words

The method of providing network security according to claim 11, wherein said plurality of security policies is selected from the group consisting of discretionary access control, mandatory access control, object reuse, labeling, denial of service detection, data type integrity, cascading control and covert channel use detection.

Claim 15

Dependent Claim 41 words

The method of providing network security according to claim 11, wherein said step of performing security management further comprises the step of establishing a defined trusted session layer protocol (TSP) through said SNIU, said TSP constituting said user layer communications protocol.

Claim 16

Dependent Claim 23 words

The method of providing network security according to claim 11, further comprising the step of controlling a data path established in said SNIU.

Claim 17

Dependent Claim 24 words

The method of providing network security according to claim 11, further comprising the step of identifying a user requesting access to the computer network.

Claim 18

Dependent Claim 45 words

The method of providing network security according to claim 11, further comprising the step of controlling a user session at a session layer of interconnection between the at least one user and the computer network if the at least one user is verified for access.

Claim 19

Dependent Claim 32 words

The method of providing network security according to claim 11, wherein functions of said SM comprises a SNIU security manager (SSM), and area security manager (ASM), and a network security manager (NSM).

Claim 20

Dependent Claim 27 words

The method of providing network security according to claim 11, further comprising the step of preventing covert information flow within said global security perimeter for end-to-end communications.

Claim 21

Dependent Claim 24 words

The method of providing network security according to claim 11, wherein said SNIU includes a data sealer for validating data transmitted through said SNIU.

Claim 22

Dependent Claim 35 words

The method of providing network security according to claim 11, wherein functions of said SM comprise exchanging data and commands with said SNIU, performing initialization, configuration control, access control, sealer key management, and audit alarms.

Claim 23

Independent Claim 163 words

A method of providing multi-level network security for a computer network having at least one user coupled thereto, the at least one user selected from a group consisting of a host computer and at least a second network, said method comprising steps of: coupling a secure network interface unit (SNIU) to at least one user and directly to the computer network, and establishing a session layer interconnection between the at least one user and the computer network, whereby the SNIU is implemented to create a global security perimeter for end-to-end communications and wherein the computer network may be individually secure or non-secure without compromising security of communications within said global security perimeter; and, performing security management utilizing a security manager (SM) for causing said SNIU to be operated and configured for controlling access to the computer network at or above the session layer by verifying at or above the session layer if an identified user is authorized for access to the computer network.

Claim 24

Independent Claim 163 words

A method of providing multi-level network security for a computer network having at least one user coupled thereto, the at least one user selected from a group consisting of a host computer and at least a second network, said method comprising steps of: coupling a secure network interface unit (SNIU) to at least one user and directly to the computer network, and establishing a session layer interconnection between the at least one user and the computer network, whereby the SNIU is implemented to create a global security perimeter for end-to-end communications and wherein the computer network may be individually secure or non-secure without compromising security of communications within said global security perimeter; and, performing security management utilizing a security manager (SM) for causing said SNIU to be operated and configured for controlling access to the computer network at or above the session layer by verifying at or above the session layer if an identified user is authorized for access to the computer network.

Claim 25

Dependent Claim 46 words

The method of providing network security according to claim 21, wherein said plurality of security policies is selected from the group consisting of discretionary access control, mandatory access control, object reuse, labeling, denial of service detection, data type integrity, cascading control and covert channel use detection.

Claim 26

Dependent Claim 41 words

The method of providing network security according to claim 21, wherein said step of performing security management further comprises the step of establishing a defined trusted session layer protocol (TSP) through said SNIU, said TSP constituting said user layer communications protocol.

Claim 27

Dependent Claim 23 words

The method of providing network security according to claim 21, further comprising the step of controlling a data path established in said SNIU.

Claim 28

Dependent Claim 24 words

The method of providing network security according to claim 21, further comprising the step of identifying a user requesting access to the computer network.

Claim 29

Dependent Claim 45 words

The method of providing network security according to claim 21, further comprising the step of controlling a user session at a session layer of interconnection between the at least one user and the computer network if the at least one user is verified for access.

Claim 30

Dependent Claim 32 words

The method of providing network security according to claim 21, wherein functions of said SM comprises a SNIU security manager (SSM), and area security manager (ASM), and a network security manager (NSM).

Claim 31

Dependent Claim 27 words

The method of providing network security according to claim 21, further comprising the step of preventing covert information flow within said global security perimeter for end-to-end communications.

Claim 32

Dependent Claim 24 words

The method of providing network security according to claim 21, wherein said SNIU includes a data sealer for validating data transmitted through said SNIU.

Claim 33

Dependent Claim 35 words

The method of providing network security according to claim 21, wherein functions of said SM comprise exchanging data and commands with said SNIU, performing initialization, configuration control, access control, sealer key management, and audit alarms.

Claim 34

Dependent Claim 96 words

A network security apparatus for providing secure communication of information communicated via an untrusted network, said apparatus comprising: at least one secure network interface unit (SNIU) coupled between a host computer and said untrusted network, said SNIU performing user authentication and bidirectional multi-level access control for information communicated via the untrusted network, said SNIU supporting accountability, data integrity, data confidentiality and network resource access policies on a per user basis, whereby said host computer and said untrusted network may be individually secure or non-secure without compromising security of communication of information communicated via the untrusted network.

Claim 35

Dependent Claim 96 words

A network security apparatus for providing secure communication of information communicated via an untrusted network, said apparatus comprising: at least one secure network interface unit (SNIU) coupled between a host computer and said untrusted network, said SNIU performing user authentication and bidirectional multi-level access control for information communicated via the untrusted network, said SNIU supporting accountability, data integrity, data confidentiality and network resource access policies on a per user basis, whereby said host computer and said untrusted network may be individually secure or non-secure without compromising security of communication of information communicated via the untrusted network.

Claim 36

Dependent Claim 22 words

The network security apparatus according to claim 31, wherein said network resource access policy include discretionary access control and mandatory access control.

Claim 37

Dependent Claim 14 words

The network security apparatus according to claim 31, wherein said accountability policy includes auditing.

Claim 38

Dependent Claim 28 words

The network security apparatus according to claim 31, said accountability, data integrity, data confidentiality and network resource access policies include labeling, cascading control, and covert channel use detection.

Claim 39

Dependent Claim 32 words

The network security apparatus according to claim 31, further comprising a security manager for causing said SNIU to be initialized, operated, and configured for protecting the security communications transmitted through said SNIU.

Claim 40

Dependent Claim 34 words

The network security apparatus according to claim 35, said SNIU further comprising an association manager operable to establish and control a user session layer of interconnection between the computer host and the untrusted network.

Claim 41

Dependent Claim 38 words

The network security apparatus according to claim 36, said SNIU further comprising a dialog manager in communication with said association manager and said security manager for setting up, controlling, and terminating a data path established in said SNIU.

Claim 42

Dependent Claim 25 words

The network security apparatus according to claim 31, said SNIU further comprising a session manager for identifying a user requesting access to the untrusted network.

Claim 43

Dependent Claim 43 words

The network security apparatus according to claim 35, said SNIU further comprising an association manager which operates to establish and control a user session at a session layer of interconnection between the computer host and the untrusted network if the user is verified.

Claim 44

Dependent Claim 31 words

The network security apparatus according to claim 31, wherein said SNIU further comprises means for performinig a defined trusted session layer protocol (TSP), said TSP constituting a user layer communications protocol.

Claim 45

Dependent Claim 148 words

A network security system for providing secure communication of information communicated via an untrusted network, said system comprising: a plurality of secure network interface units (SNIUs) each coupled between a respective host computer and said untrusted network, each said SNIU performing user authentication and bidirectional multi-level access control for information communicated via the untrusted network, said SNIU supporting accountability, data integrity, data confidentiality and network resource access policies on a per user basis, whereby said host computer and said untrusted network may be individually secure or non-secure without compromising security of information communicated via the untrusted network; and a security management architecture including a security manager (SM) coupled to each said SNIU having means for causing each SNIU to be initialized, operated and configured for protecting the security communications transmitted through each said SNIU, said SM capable of implementing at least one of a plurality of security policies.

Claim 46

Dependent Claim 148 words

A network security system for providing secure communication of information communicated via an untrusted network, said system comprising: a plurality of secure network interface units (SNIUs) each coupled between a respective host computer and said untrusted network, each said SNIU performing user authentication and bidirectional multi-level access control for information communicated via the untrusted network, said SNIU supporting accountability, data integrity, data confidentiality and network resource access policies on a per user basis, whereby said host computer and said untrusted network may be individually secure or non-secure without compromising security of information communicated via the untrusted network; and a security management architecture including a security manager (SM) coupled to each said SNIU having means for causing each SNIU to be initialized, operated and configured for protecting the security communications transmitted through each said SNIU, said SM capable of implementing at least one of a plurality of security policies.

Claim 47

Dependent Claim 26 words

The network security system according to claim 41, wherein at least one of said plurality of SNIUs is operative to act as a gateway between networks.

Claim 48

Dependent Claim 200 words

A multi-level network security apparatus for communicating over an untrusted network between a computer user and at least a second network, comprising: a secure network interface unit (SNIU) coupled at a first port to said computer user and at a second port to said untrusted network, said SNIU providing security control by controlling access and communications to the untrusted network, said SNIU operable to initialize and maintain a communication path across the untrusted network and said at least one second network with a remote SNIU for passing data therebetween; said remote SNIU coupled directly between said untrusted network and said second network and operable as a gateway to communicate with said SNIU over said communication path to transceive data at said second network when said second network uses different security labeling than said untrusted network; wherein each SNIU is implemented to create a global security perimeter for end-to-end communications; and a security management architecture including a security manager (SM) coupled to each said SNIU having means for causing each SNIU to be initialized, operated and configured for protecting the security communications transmitted through each said SNIU, said SM capable of implementing at least one of a plurality of security policies.

Claim 49

Dependent Claim 200 words

A multi-level network security apparatus for communicating over an untrusted network between a computer user and at least a second network, comprising: a secure network interface unit (SNIU) coupled at a first port to said computer user and at a second port to said untrusted network, said SNIU providing security control by controlling access and communications to the untrusted network, said SNIU operable to initialize and maintain a communication path across the untrusted network and said at least one second network with a remote SNIU for passing data therebetween; said remote SNIU coupled directly between said untrusted network and said second network and operable as a gateway to communicate with said SNIU over said communication path to transceive data at said second network when said second network uses different security labeling than said untrusted network; wherein each SNIU is implemented to create a global security perimeter for end-to-end communications; and a security management architecture including a security manager (SM) coupled to each said SNIU having means for causing each SNIU to be initialized, operated and configured for protecting the security communications transmitted through each said SNIU, said SM capable of implementing at least one of a plurality of security policies.

Claim 50

Dependent Claim 68 words

The apparatus of claim 4, wherein said means for performing said SM functions are distributed over three platforms, i.e., a SNIU security manager (SSM), an area security manager (ASM) and a network security manager (NSM), wherein an NSM associated with said untrusted network and said SNIU and a second NSM associated with said second network and said remote SNIU both operate to control and initialize said remote SNIU.

Claim 51

Dependent Claim 214 words

A multi-level network security apparatus for communicating over an untrusted network between a computer user and at least a second network, comprising: a secure network interface unit (SNIU) coupled at a first port to said computer user and at a second port to said untrusted network, said SNIU providing security control by controlling access and communications to the untrusted network, said SNIU operable to initialize and maintain a communication path across the untrusted network and said at least one second network with a remote SNIU for passing data therebetween via duplex, simplex, or multicast communications means; said remote SNIU coupled directly between said untrusted network and said second network and operable as a router to communicate with said SNIU over said communication path to transceive data at said second network when said second network uses the same security labeling as said untrusted network and operates at different protection levels; wherein each SNIU is implemented to create a global security perimeter for end-to-end communications; and a security management architecture including a security manager (SM) coupled to each said SNIU having means for causing each SNIU to be initialized, operated and configured for protecting the security communications transmitted through each said SNIU, said SM capable of implementing at least one of a plurality of security policies.

Claim 52

Dependent Claim 214 words

A multi-level network security apparatus for communicating over an untrusted network between a computer user and at least a second network, comprising: a secure network interface unit (SNIU) coupled at a first port to said computer user and at a second port to said untrusted network, said SNIU providing security control by controlling access and communications to the untrusted network, said SNIU operable to initialize and maintain a communication path across the untrusted network and said at least one second network with a remote SNIU for passing data therebetween via duplex, simplex, or multicast communications means; said remote SNIU coupled directly between said untrusted network and said second network and operable as a router to communicate with said SNIU over said communication path to transceive data at said second network when said second network uses the same security labeling as said untrusted network and operates at different protection levels; wherein each SNIU is implemented to create a global security perimeter for end-to-end communications; and a security management architecture including a security manager (SM) coupled to each said SNIU having means for causing each SNIU to be initialized, operated and configured for protecting the security communications transmitted through each said SNIU, said SM capable of implementing at least one of a plurality of security policies.

Claim 53

Independent Claim 129 words

A method for providing multi-level network security for an untrusted computer network having at least one host computer associated with a user coupled thereto, said method comprising the steps of: coupling a secure network interface unit (SNIU) between said at least one host computer and said untrusted network, establishing a session layer interconnection between said at least one host computer and the untrusted network, performing user authentication and bi-directional multi-level access control for information communicated via said untrusted network utilizing said SNIU; and performing security management by providing accountability, data integrity, data confidentiality, and network resource access policies on a per user basis, whereby said host computer and said untrusted network may be individually secure or non-secure without compromising security of communication of information communicated via the untrusted network.

Claim 54

Independent Claim 129 words

A method for providing multi-level network security for an untrusted computer network having at least one host computer associated with a user coupled thereto, said method comprising the steps of: coupling a secure network interface unit (SNIU) between said at least one host computer and said untrusted network, establishing a session layer interconnection between said at least one host computer and the untrusted network, performing user authentication and bi-directional multi-level access control for information communicated via said untrusted network utilizing said SNIU; and performing security management by providing accountability, data integrity, data confidentiality, and network resource access policies on a per user basis, whereby said host computer and said untrusted network may be individually secure or non-secure without compromising security of communication of information communicated via the untrusted network.

Claim 55

Dependent Claim 40 words

The method of providing network security according to claim 46, wherein said step of performing security management further comprises the step of establishing a defined trusted session layer protocol (TSP) through said SNIU, said TSP constituting user layer communications protocol.

Claim 56

Dependent Claim 23 words

The method of providing network security according to claim 46, further comprising the step of controlling a data path established in said SNIU.

Claim 57

Dependent Claim 28 words

The method of providing network security according to claim 46, further comprising the step of identifying a user associated with a host computer requesting access to the network.

Claim 58

Dependent Claim 44 words

The method of providing network security according to claim 49, further comprising the step of controlling a user session at a session layer of interconnection between the at least one host computer and the untrusted network if the associated user is verified for access.

Claim 59

Dependent Claim 35 words

The method of providing network security according to claim 46, wherein the step of performing security management further comprises preventing covert information flow within a global security perimeter associated with the SNIU for end-to-end communications.

Claim 60

Dependent Claim 36 words

The method of providing network security according to claim 46, wherein functions of said security management comprise exchanging data and commands with said SNIU, performing initialization, configuration control, access control, sealer key management, and audit alarms.

Claim 61

Dependent Claim 118 words

A network security apparatus for providing secure communication of information communicated via an untrusted network, said apparatus comprising: bidirectional means for performing user authentication and bidirectional multi-level access control for information communicated via the untrusted network; security means for causing said bi-directional means to be initialized, operated, and configured for protecting the security communications transmitted to said bi-directional means, said security means capable of implementing at least one of a plurality security policies on a per user basis, wherein said bidirectional means is coupled between a host computer and said untrusted network, whereby said host computer and said untrusted network may be individually secure or non-secure without compromising security of communication of information communicated by said untrusted network.

Claim 62

Dependent Claim 118 words

A network security apparatus for providing secure communication of information communicated via an untrusted network, said apparatus comprising: bidirectional means for performing user authentication and bidirectional multi-level access control for information communicated via the untrusted network; security means for causing said bi-directional means to be initialized, operated, and configured for protecting the security communications transmitted to said bi-directional means, said security means capable of implementing at least one of a plurality security policies on a per user basis, wherein said bidirectional means is coupled between a host computer and said untrusted network, whereby said host computer and said untrusted network may be individually secure or non-secure without compromising security of communication of information communicated by said untrusted network.

Claim 63

Dependent Claim 42 words

A network security apparatus according to claim 53, wherein said plurality of security policies is selected from a group consisting of discretionary access control, mandatory access control, labeling, denial of service detection, data typing integrity, cascading control, and covert channel use detection.

Annuity Stage	Window Opens	Payment Deadline	Surcharge Period Until	Estimated Fee	Status
3.5 Years (Year 4)	2002-08-16	2003-02-15	2003-08-17	$2000.00	Window Closed / Lapsed
7.5 Years (Year 8)	2006-08-16	2007-02-15	2007-08-17	$3760.00	Window Closed / Lapsed
11.5 Years (Year 12)	2010-08-16	2011-02-15	2011-08-17	$7700.00	Window Closed / Lapsed

Apparatus and method for providing network security

Abstract

Inventors

Bibliographic Details

Claims Analysis

References Cited (Backward Citations)

USPTO Annuity & Maintenance Windows

Assigned Categories & Tags

Assign Category Tag