Patent US5968176A successfully refreshed from Google Patents.
US5968176A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Multilayer firewall system
Assignee: HP Inc
•
Filing: 1997-05-29
•
Granted: 1999-10-19
•
Expires: 2017-05-29
Abstract
Abstract A system provides for establishing security in a network that include nodes having security functions operating in multiple protocol layers. Multiple network devices, such as remote access equipment, routers, switches, repeaters and network cards having security functions are configured to contribute to implementation of distributed firewall functions in the network. By distributing firewall functionality throughout many layers of the network in a variety of network devices, a pervasive firewall is implemented. The pervasive, multilayer firewall includes a policy definition component that accepts policy data that defines how the firewall should behave. The policy definition component can be a centralized component, or a component that is distributed over the network. The multilayer firewall also includes a collection of network devices that are used to enforce the defined policy. The security functions operating in this collection of network devices across multiple protocol layers are coordinated by the policy definition component so that particular devices enforce that part of the policy pertinent to their part of the network.
Inventors
- 👤 Danny M. Nessett
- 👤 William Paul Sherer
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-04 06:25
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0209; H04L63/0218; H04L63/0227; H04L63/0263; H04L63/10; H04L63/102
Claims Analysis
Total Claims: 79
Claim 1
Independent Claim
201 words
A system providing multiple protocol layer security in a network including nodes of a plurality of network device types, with nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node in the network, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes in the network; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality of types of nodes in the network, and which conveys the configuration data to the nodes, wherein the security functions operating in the plurality of network device types across multiple protocol layers are coordinated by the security policy so that particular device types enforce the part of the security policy pertinent to the associated part of the network.
Claim 2
Independent Claim
201 words
A system providing multiple protocol layer security in a network including nodes of a plurality of network device types, with nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node in the network, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes in the network; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality of types of nodes in the network, and which conveys the configuration data to the nodes, wherein the security functions operating in the plurality of network device types across multiple protocol layers are coordinated by the security policy so that particular device types enforce the part of the security policy pertinent to the associated part of the network.
Claim 3
Dependent Claim
39 words
The system of claim 1, wherein the set of the nodes in the network includes nodes providing medium access control (MAC) layer filtering according to filter parameters, and the configuration data includes filter parameters for the MAC layer filtering.
Claim 4
Dependent Claim
36 words
The system of claim 1, wherein the set of the nodes in the network includes nodes providing network layer filtering according to filter parameters, and the configuration data includes filter parameters for the network layer filtering.
Claim 5
Dependent Claim
36 words
The system of claim 1, wherein the set of the nodes in the network includes nodes providing transport layer filtering according to filter parameters, and the configuration data includes filter parameters for the transport layer filtering.
Claim 6
Dependent Claim
36 words
The system of claim 1, wherein the set of the nodes in the network includes nodes providing application layer filtering according to filter parameters, and the configuration data includes filter parameters for the application layer filtering.
Claim 7
Dependent Claim
12 words
The system of claim 1, wherein the security functions include authentication protocols.
Claim 8
Dependent Claim
11 words
The system of claim 1, wherein the security functions include auditing.
Claim 9
Dependent Claim
11 words
The system of claim 1, wherein the security functions include authorization.
Claim 10
Dependent Claim
34 words
The system of claim 1, wherein the set of the nodes in the network includes nodes executing repeater functions, and the security functions include medium access control MAC layer filtering in the repeater functions.
Claim 11
Dependent Claim
37 words
The system of claim 1, wherein the set of the nodes in the network includes nodes executing data link layer switch functions, and the security functions include medium access control MAC layer filtering in the switch functions.
Claim 12
Dependent Claim
33 words
The system of claim 1, wherein the set of the nodes in the network includes nodes executing network layer routing functions, and the security functions include network layer filtering in the routing functions.
Claim 13
Dependent Claim
29 words
The system of claim 1, wherein the set of the nodes in the network includes nodes executing multiple protocol layer routing functions, and the security functions include authentication mechanisms.
Claim 14
Dependent Claim
44 words
The system of claim 1, wherein the set of the nodes in the network includes nodes executing network layer routing functions and nodes executing data link layer switch functions, and the security functions include medium access control MAC layer filtering and network layer filtering.
Claim 15
Dependent Claim
28 words
The system of claim 13, wherein the set of the nodes in the network includes nodes executing multiple protocol layer routing functions, and the security functions include authentication.
Claim 16
Dependent Claim
29 words
The system of claim 1, wherein the topology data store includes data indicating nodes coupled to network links to nodes external to the set of nodes in the network.
Claim 17
Dependent Claim
24 words
The system of claim 1, wherein the configuration interface includes a script interpreter which interprets a script language to determine the security policy statements.
Claim 18
Dependent Claim
49 words
The system of claim 16, wherein the script language includes a syntax for specifying a security policy statement including a source set identifier, a destination set identifier, a communication activity identifier, and a rule for the identified communication activity between the identified source set and the identified destination set.
Claim 19
Dependent Claim
23 words
The system of claim 17, wherein the syntax further includes an identifier of the location at which the rule is to be enforced.
Claim 20
Dependent Claim
44 words
The system of claim 1, including a configuration store having persistent storage capability in communication with a particular node in the set of the nodes in the network, and wherein the configuration driver transmits configuration data for the particular node to the configuration store.
Claim 21
Dependent Claim
19 words
The system of claim 19, wherein the configuration store is coupled with the particular node by a communication link.
Claim 22
Independent Claim
227 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes, wherein the topology data store includes data indicating nodes coupled to network links to nodes external to the set of nodes, active nodes in the network capable of enforcing a security policy and passive nodes which are incapable of enforcing, or not trusted to enforce, a security policy; and wherein the security policy statements indicate security policies for active nodes, passive nodes, and for communications traversing network links to nodes external to the set of the nodes in the network; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality of types of nodes in the network, and which conveys the configuration data to the nodes.
Claim 23
Independent Claim
227 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes, wherein the topology data store includes data indicating nodes coupled to network links to nodes external to the set of nodes, active nodes in the network capable of enforcing a security policy and passive nodes which are incapable of enforcing, or not trusted to enforce, a security policy; and wherein the security policy statements indicate security policies for active nodes, passive nodes, and for communications traversing network links to nodes external to the set of the nodes in the network; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality of types of nodes in the network, and which conveys the configuration data to the nodes.
Claim 24
Independent Claim
179 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes, wherein the topology data store includes data indicating active nodes capable for enforcing a security policy and passive nodes which are incapable of enforcing, or not trusted to enforce, a security policy; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality of types of nodes in the network, and which conveys the configuration data to the nodes.
Claim 25
Independent Claim
179 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes, wherein the topology data store includes data indicating active nodes capable for enforcing a security policy and passive nodes which are incapable of enforcing, or not trusted to enforce, a security policy; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality of types of nodes in the network, and which conveys the configuration data to the nodes.
Claim 26
Dependent Claim
35 words
The system of claim 18, wherein the security policy statements indicate security policies for communication between a source set of one or more end stations and a destination set of one or more end stations.
Claim 27
Dependent Claim
29 words
The system of claim 22, wherein the configuration driver includes resources to enforce security policies for passive nodes by generating configuration data for active nodes linked to passive nodes.
Claim 28
Independent Claim
231 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network, wherein the configuration interface includes a script interpreter which interprets a script language to determine the security policy statements, wherein the script language includes a syntax for specifying a security policy statement including a source set identifier, a destination identifier, a communication activity identifier, and a rule for the identified communication activity between the identified source set and the identified destination set; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality configuration data to the network, and which conveys the configuration data to the nodes, wherein the configuration driver includes resources to identify security policy statements which cannot be enforced according to the data in the topology data store.
Claim 29
Independent Claim
231 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network, wherein the configuration interface includes a script interpreter which interprets a script language to determine the security policy statements, wherein the script language includes a syntax for specifying a security policy statement including a source set identifier, a destination identifier, a communication activity identifier, and a rule for the identified communication activity between the identified source set and the identified destination set; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality configuration data to the network, and which conveys the configuration data to the nodes, wherein the configuration driver includes resources to identify security policy statements which cannot be enforced according to the data in the topology data store.
Claim 30
Independent Claim
200 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes, wherein the topology data store includes data structures providing information for particular nodes, including network layer addresses, medium access control MAC layer addresses, user identifiers, whether or not the particular node is trusted to enforce security policy, the type of security policy it is able to enforce, and its connections to other nodes; a configuration interface, coupled to the topology data store including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality of types of nodes in the network, and which conveys the configuration data to the nodes.
Claim 31
Independent Claim
200 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes, wherein the topology data store includes data structures providing information for particular nodes, including network layer addresses, medium access control MAC layer addresses, user identifiers, whether or not the particular node is trusted to enforce security policy, the type of security policy it is able to enforce, and its connections to other nodes; a configuration interface, coupled to the topology data store including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality of types of nodes in the network, and which conveys the configuration data to the nodes.
Claim 32
Independent Claim
227 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network, wherein the security policy statements indicate security policies for communication between a source set including one or more end stations in the network, and a destination set including one or more end stations in the network, and wherein the configuration driver includes resources to identify a cut vertex set of nodes capable of enforcing the indicated security policies within the set of nodes in the network, and to establish the configuration data in the nodes in the cut vertex set; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality of types of nodes in the network, and which conveys the configuration data to the nodes.
Claim 33
Independent Claim
227 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node, comprising: a topology data store, storing information about security functions operating in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented among nodes in the network, wherein the security policy statements indicate security policies for communication between a source set including one or more end stations in the network, and a destination set including one or more end stations in the network, and wherein the configuration driver includes resources to identify a cut vertex set of nodes capable of enforcing the indicated security policies within the set of nodes in the network, and to establish the configuration data in the nodes in the cut vertex set; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for the plurality of types of nodes in the network, and which conveys the configuration data to the nodes.
Claim 34
Dependent Claim
17 words
The system of claim 27, wherein said cut vertex set consists of a minimal cut vertex set.
Claim 35
Independent Claim
278 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node in the network, comprising: a topology data store, storing information about security functions in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes in the network, the topology data store including data structures providing information for particular nodes, including addresses at one or more protocol layers, whether or not the particular node is trusted to enforce security policy, the type of security policy the particular node is able to enforce, and connections of the particular node to other nodes; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented between source sets of one or more end stations and destination sets of one or more end stations in the network, including a script interpreter which interprets a script language to determine the security policy statements, and the script language includes a syntax for specifying a security policy statement including a source set identifier, a destination set identifier, a communication activity identifier, and a rule for the identified communication activity between the identified source set and the identified destination set; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for various types of nodes in the network, and which send the configuration data to the nodes.
Claim 36
Independent Claim
278 words
A system providing security in a network including nodes of a plurality of types, nodes in a set of the nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node in the network, comprising: a topology data store, storing information about security functions in the set of the nodes in the network, and about interconnection of nodes in the set of the nodes in the network, the topology data store including data structures providing information for particular nodes, including addresses at one or more protocol layers, whether or not the particular node is trusted to enforce security policy, the type of security policy the particular node is able to enforce, and connections of the particular node to other nodes; a configuration interface, coupled to the topology data store, including an input by which to receive security policy statements indicating security policies to be implemented between source sets of one or more end stations and destination sets of one or more end stations in the network, including a script interpreter which interprets a script language to determine the security policy statements, and the script language includes a syntax for specifying a security policy statement including a source set identifier, a destination set identifier, a communication activity identifier, and a rule for the identified communication activity between the identified source set and the identified destination set; and a configuration driver, coupled to the network, the configuration interface, and the topology data store, including resources which translate the security policy statements into configuration data for various types of nodes in the network, and which send the configuration data to the nodes.
Claim 37
Dependent Claim
39 words
The system of claim 29, wherein the set of the nodes in the network includes nodes providing medium access control (MAC) layer filtering according to filter parameters, and the configuration data includes filter parameters for the MAC layer filtering.
Claim 38
Dependent Claim
36 words
The system of claim 29, wherein the set of the nodes in the network includes nodes providing network layer filtering according to filter parameters, and the configuration data includes filter parameters for the network layer filtering.
Claim 39
Dependent Claim
36 words
The system of claim 29, wherein the set of the nodes in the network includes nodes providing transport layer filtering according to filter parameters, and the configuration data includes filter parameters for the transport layer filtering.
Claim 40
Dependent Claim
36 words
The system of claim 29, wherein the set of the nodes in the network includes nodes providing application layer filtering according to filter parameters, and the configuration data includes filter parameters for the application layer filtering.
Claim 41
Dependent Claim
37 words
The system of claim 29, wherein the topology data store includes data indicating active nodes capable of enforcing a security policy and passive nodes which are incapable of enforcing, or not trusted to enforce, a security policy.
Claim 42
Dependent Claim
29 words
The system of claim 29, wherein the topology data store includes data indicating nodes in the network coupled to network links to nodes external to the set of nodes.
Claim 43
Dependent Claim
30 words
The system of claim 35, wherein the security policy statements indicate security policies for communications traversing network links to nodes external to the set of the nodes in the network.
Claim 44
Dependent Claim
23 words
The system of claim 29, wherein the syntax further includes an identifier of a location at which the rule is to be enforced.
Claim 45
Dependent Claim
29 words
The system of claim 29, wherein the configuration driver includes resources to identify security policy statements which cannot be enforced according to the data in the topology data store.
Claim 46
Dependent Claim
44 words
The system of claim 29, including a configuration store having persistent storage capability in communication with a particular node in the set of the nodes in the network, and wherein the configuration driver transmits configuration data for the particular node to the configuration store.
Claim 47
Dependent Claim
19 words
The system of claim 39, wherein the configuration store is coupled with the particular node by a communication link.
Claim 48
Dependent Claim
39 words
The system of claim 29, wherein the configuration driver includes resources to identify a cut vertex set of nodes capable of enforcing the indicated security policies, and to establish the configuration data in nodes in the cut vertex set.
Claim 49
Dependent Claim
17 words
The system of claim 41, wherein said cut vertex set consists of a minimal cut vertex set.
Claim 50
Independent Claim
173 words
A method for establishing a firewall system in a network including a set of nodes of a plurality of types, nodes in the set of nodes in the network including security functions executing in response to configuration data adapted for the corresponding node, comprising: providing topology data including information about security functions operating in nodes in the set, and about interconnection of nodes in the set, providing security policy statements indicating security policies to be implemented among end systems in the set; translating, in response to the topology data, the security policy statements into configuration data for security functions operating at nodes in the set; and establishing the configuration data in the security functions at the nodes in the network; wherein the topology data includes data structures providing information for particular nodes, including addresses at one or more protocol layers, whether or not the particular node is trusted to enforce security policy, the type of security policy the particular node is able to enforce, and connections of the particular node to other nodes.
Claim 51
Independent Claim
173 words
A method for establishing a firewall system in a network including a set of nodes of a plurality of types, nodes in the set of nodes in the network including security functions executing in response to configuration data adapted for the corresponding node, comprising: providing topology data including information about security functions operating in nodes in the set, and about interconnection of nodes in the set, providing security policy statements indicating security policies to be implemented among end systems in the set; translating, in response to the topology data, the security policy statements into configuration data for security functions operating at nodes in the set; and establishing the configuration data in the security functions at the nodes in the network; wherein the topology data includes data structures providing information for particular nodes, including addresses at one or more protocol layers, whether or not the particular node is trusted to enforce security policy, the type of security policy the particular node is able to enforce, and connections of the particular node to other nodes.
Claim 52
Dependent Claim
64 words
The method of claim 43, wherein the step of providing the security policy statements includes interpreting a script language to determine the security policy statements, the script language including a syntax for specifying a security policy statement including a source identifier, a destination identifier, a communication activity identifier, and a rule for the identified communication activity between the identified source and the identified destination.
Claim 53
Dependent Claim
23 words
The method of claim 44, wherein the syntax further includes an identifier of the location at which the rule is to be enforced.
Claim 54
Dependent Claim
26 words
The method of claim 43, wherein the step of establishing includes transmitting the configuration data on the network to persistent storage in communication with the nodes.
Claim 55
Dependent Claim
44 words
The method of claim 46, wherein for at least one node, the persistent storage in communication with the node is local to the node, and for at least one other node the persistent storage in communication with the node is remote from the node.
Claim 56
Dependent Claim
59 words
The method of claim 46, wherein for at least one node, the persistent storage in communication with the node is remote from the node, and the step of establishing the configuration data at the node includes after transmitting the configuration data to the persistent storage, signaling the security function at the node that the configuration data has been changed.
Claim 57
Dependent Claim
36 words
The method of claim 43, wherein the topology data includes data indicating active nodes capable of enforcing a security policy and passive nodes which are incapable of enforcing, or not trusted to enforce, a security policy.
Claim 58
Dependent Claim
31 words
The method of claim 49, wherein the topology data includes data indicating nodes in the network coupled to network links to nodes external to the set of nodes in the network.
Claim 59
Dependent Claim
30 words
The method of claim 50, wherein the security policy statements indicate security policies for communications traversing network links to nodes external to the set of the nodes in the network.
Claim 60
Dependent Claim
28 words
The method of claim 49, wherein the step of translating includes, to enforce security policies for passive nodes, generating configuration data for active nodes linked to passive nodes.
Claim 61
Dependent Claim
28 words
The method of claim 43, wherein the step of translating includes identifying security policy statements which cannot be enforced according to the data in the topology data store.
Claim 62
Dependent Claim
36 words
The method of claim 43, wherein the set of the nodes in the network includes nodes providing MAC layer filtering according to filter parameters, and the configuration data includes filter parameters for the MAC layer filtering.
Claim 63
Dependent Claim
36 words
The method of claim 43, wherein the set of the nodes in the network includes nodes providing network layer filtering according to filter parameters, and the configuration data includes filter parameters for the network layer filtering.
Claim 64
Dependent Claim
36 words
The method of claim 43, wherein the set of the nodes in the network includes nodes providing transport layer filtering according to filter parameters, and the configuration data includes filter parameters for the transport layer filtering.
Claim 65
Dependent Claim
36 words
The method of claim 43, wherein the set of the nodes in the network includes nodes providing application layer filtering according to filter parameters, and the configuration data includes filter parameters for the application layer filtering.
Claim 66
Dependent Claim
11 words
The method of claim 43, wherein the security functions include authorization.
Claim 67
Dependent Claim
11 words
The method of claim 43, wherein the security functions include authentication.
Claim 68
Dependent Claim
11 words
The method of claim 43, wherein the security functions include auditing.
Claim 69
Dependent Claim
35 words
The method of claim 43, wherein the set of the nodes in the network includes nodes providing network layer filtering according to Internet Protocol (IP) filter parameters, and the configuration data includes IP filter parameters.
Claim 70
Dependent Claim
37 words
The method of claim 43, wherein the set of the nodes in the network includes nodes providing filtering according to Internet protocol and transport control protocol (TCP/IP) filter parameters, and the configuration data includes TCP/IP filter parameters.
Claim 71
Independent Claim
187 words
A method for establishing a firewall system in a network including a set of nodes of a plurality of types, nodes in the set of nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node in the network, comprising: providing topology data including information about security functions operating in nodes in the set, and about interconnection of nodes in the set; providing security policy statements indicating security policies to be implemented between a source set of end stations and a destination set of end stations in the set; identifying, in response to the topology data and the security policy statements, a cut vertex set of nodes consisting of nodes capable of enforcing the security policy statements, and which if removed from the network would isolate the source set from the destination set; translating, in response to the identified cut vertex set and the security policy statements, into configuration data for security functions operating at nodes in the cut vertex set; and establishing the configuration data in the security functions at the nodes in the cut vertex set.
Claim 72
Independent Claim
187 words
A method for establishing a firewall system in a network including a set of nodes of a plurality of types, nodes in the set of nodes in the network including security functions executing in response to configuration data adapted for the corresponding type of node in the network, comprising: providing topology data including information about security functions operating in nodes in the set, and about interconnection of nodes in the set; providing security policy statements indicating security policies to be implemented between a source set of end stations and a destination set of end stations in the set; identifying, in response to the topology data and the security policy statements, a cut vertex set of nodes consisting of nodes capable of enforcing the security policy statements, and which if removed from the network would isolate the source set from the destination set; translating, in response to the identified cut vertex set and the security policy statements, into configuration data for security functions operating at nodes in the cut vertex set; and establishing the configuration data in the security functions at the nodes in the cut vertex set.
Claim 73
Dependent Claim
52 words
The method of claim 63, wherein the topology data includes data structures providing information for particular nodes, including addresses, whether or not the particular node is trusted to enforce security policy, the type of security policy the particular node is able to enforce, and connections of the particular node to other nodes.
Claim 74
Dependent Claim
64 words
The method of claim 63, wherein the step of providing the security policy statements includes interpreting a script language to determine the security policy statements, the script language including a syntax for specifying a security policy statement including a source identifier, a destination identifier, a communication activity identifier, and a rule for the identified communication activity between the identified source and the identified destination.
Claim 75
Dependent Claim
31 words
The method of claim 63, wherein the step of establishing includes transmitting the configuration data on the network to persistent storage in communication with the nodes in the cut vertex set.
Claim 76
Dependent Claim
44 words
The method of claim 66, wherein for at least one node, the persistent storage in communication with the node is local to the node, and for at least one other node the persistent storage in communication with the node is remote from the node.
Claim 77
Dependent Claim
35 words
The method of claim 63, wherein the set of the nodes in the network includes nodes providing network layer filtering according to Internet Protocol (IP) filter parameters, and the configuration data includes IP filter parameters.
Claim 78
Dependent Claim
37 words
The method of claim 63, wherein the set of the nodes in the network includes nodes providing filtering according to Internet protocol and transport control protocol (TCP/IP) filter parameters, and the configuration data includes TCP/IP filter parameters.
Claim 79
Dependent Claim
17 words
The method of claim 63, wherein said cut vertex set consists of a minimal cut vertex set.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-10-18 | 2003-04-19 | 2003-10-19 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-10-18 | 2007-04-19 | 2007-10-19 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-10-18 | 2011-04-19 | 2011-10-19 | $7700.00 | Window Closed / Lapsed |