Patent US368250A successfully refreshed from Google Patents.
Patent US8977745B2 successfully refreshed from Google Patents.
US8977745B2
Active / In Force
US
⏱️ 6.3 years remaining
Methods, communication networks, and computer program products for monitoring, examining, and/or blocking traffic associated with a network element based on whether the network element can be trusted
Assignee: AT&T Intellectual Property I LP
•
Filing: 2013-02-18
•
Granted: 2015-03-10
•
Expires: 2033-02-18
Abstract
Abstract A communication network is operated by determining whether a network element can be trusted and monitoring traffic associated with the network element based on whether the network element can be trusted. At least some of the monitored traffic may be selected for examination based on the degree of trust for the network element. At least some of the monitored and/or examined traffic is selected to be blocked based on the degree of trust for the network element.
Inventors
- 👤 Jeffrey A. Aaron
- 👤 Edgar Vaughan Shrum, Jr.
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-08 19:53
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/14; H04L63/1408; H04L63/02; H04L63/0227; H04L63/0263; H04L63/1441; H04L67/00; H04L67/01; H04L67/10; H04L67/104; H04L67/1044; H04L67/1053; H04L67/1057
Claims Analysis
Total Claims: 17
Claim 1
Independent Claim
395 words
A method of operating a communication network, comprising: determining whether a network element can be trusted, wherein determining whether a network element can be trusted comprises: generating a first hash value based on data associated with the network element wherein the first hash value is based on a configuration of the network element at a first time and the first hash value is an acceptable result for the configuration of the network element; generating a second hash value based on the data associated with the network element wherein the second hash value is based on a configuration of the network element at a second time different than the first time; comparing the first hash value with the second hash value to determine whether the network element can be trusted based on whether a change has occurred in the configuration of the network between the first time and the second time; monitoring traffic associated with the network element based on whether the network element can be trusted; and selecting some of the traffic that was monitored to be blocked based on the degree of trust for the network element; wherein monitoring traffic comprises: monitoring the traffic using rules to determine if the traffic contains unexpected information based on the degree of trust for the network element; providing results with respect to whether the traffic contains unexpected information to a human expert interface based on the degree of trust for the network element; selecting traffic for monitoring using rules that are based on network element trust information; and selecting some of the traffic that was monitored for examination based on a degree of trust for the network element; wherein monitoring traffic further comprises: specifying the traffic to be monitored based on traffic classification; examining the traffic that was monitored and was selected using rules using a level of examination selected from a plurality of levels of examination to determine whether the traffic contains unexpected information based on the degree of trust for the network element; and providing results with respect to whether the traffic that was monitored and was selected using rules contains unexpected information to the human expert interface based on the degree of trust for the network element; wherein the level of examination of the traffic that was monitored and was selected using rules is based on the degree of trust for the network element.
Claim 2
Independent Claim
395 words
A method of operating a communication network, comprising: determining whether a network element can be trusted, wherein determining whether a network element can be trusted comprises: generating a first hash value based on data associated with the network element wherein the first hash value is based on a configuration of the network element at a first time and the first hash value is an acceptable result for the configuration of the network element; generating a second hash value based on the data associated with the network element wherein the second hash value is based on a configuration of the network element at a second time different than the first time; comparing the first hash value with the second hash value to determine whether the network element can be trusted based on whether a change has occurred in the configuration of the network between the first time and the second time; monitoring traffic associated with the network element based on whether the network element can be trusted; and selecting some of the traffic that was monitored to be blocked based on the degree of trust for the network element; wherein monitoring traffic comprises: monitoring the traffic using rules to determine if the traffic contains unexpected information based on the degree of trust for the network element; providing results with respect to whether the traffic contains unexpected information to a human expert interface based on the degree of trust for the network element; selecting traffic for monitoring using rules that are based on network element trust information; and selecting some of the traffic that was monitored for examination based on a degree of trust for the network element; wherein monitoring traffic further comprises: specifying the traffic to be monitored based on traffic classification; examining the traffic that was monitored and was selected using rules using a level of examination selected from a plurality of levels of examination to determine whether the traffic contains unexpected information based on the degree of trust for the network element; and providing results with respect to whether the traffic that was monitored and was selected using rules contains unexpected information to the human expert interface based on the degree of trust for the network element; wherein the level of examination of the traffic that was monitored and was selected using rules is based on the degree of trust for the network element.
Claim 3
Dependent Claim
47 words
The method of claim 1 , wherein comparing the first hash value with the second hash value to determine whether the network element can be trusted comprises comparing the first hash value with the second hash value to determine a degree of trust for the network element.
Claim 4
Dependent Claim
28 words
The method of claim 1 , wherein monitoring traffic further comprises: specifying the traffic to be monitored based on one of a time duration and a traffic amount.
Claim 5
Dependent Claim
36 words
The method of claim 1 , wherein monitoring the traffic further comprises: obtaining input via the human expert interface; and revising the results with respect to whether the traffic contains unexpected information based on the input.
Claim 6
Dependent Claim
48 words
The method of claim 1 , further comprising: examining the some of the traffic that was monitored using one of rules, pattern matching techniques, and deviation from expected values techniques to determine if the traffic contains unexpected information based on the degree of trust for the network element.
Claim 7
Dependent Claim
47 words
The method of claim 5 , wherein examining the some of the traffic that was monitored comprises: obtaining input via the human expert interface; and revising the results with respect to whether the some of the traffic that was monitored contains unexpected information based on the input.
Claim 8
Dependent Claim
34 words
The method of claim 1 , further comprising: blocking the some of the traffic to be blocked using filtering based on one of source address, destination address, port, protocol, and state of a connection.
Claim 9
Dependent Claim
39 words
The method of claim 7 , wherein blocking the some of the traffic to be blocked comprises: obtaining input via the human expert interface; and permanently blocking the some of the traffic to be blocked based on the input.
Claim 10
Dependent Claim
31 words
The method of claim 1 , further comprising: modifying rules, pattern matching techniques, and deviation from expected values techniques used in monitoring the traffic and examining the some of the traffic.
Claim 11
Dependent Claim
75 words
A method according to claim 1 wherein the network element is a communications device comprising one of a router, a gateway, a switching device, a cable modem, a digital subscriber line modem, a public switched telephone network modem, a wireless local area network modem, a wireless wide area network modem, a computer with a modem, a mobile terminal with a modem, a personal data assistant with a modem, and a cellular telephone with a modem.
Claim 12
Independent Claim
404 words
A system, comprising: a processor; and a memory coupled to the processor and comprising computer readable program code embodied in the memory that when executed by the processor causes the processor to perform operations comprising: generating a first hash value based on data associated with the network element wherein the first hash value is based on a configuration of the network element at a first time and the first hash value is an acceptable result for the configuration of the network element; generating a second hash value based on the data associated with the network element wherein the second hash value is based on a configuration of the network element at a second time different than the first time; comparing the first hash value with the second hash value to determine whether the network element can be trusted based on whether a change has occurred in the configuration of the network between the first time and the second time; monitoring traffic associated with the network element based on whether the network element can be trusted; and selecting some of the traffic that was monitored to be blocked based on the degree of trust for the network element; wherein monitoring traffic comprises: monitoring the traffic using rules to determine if the traffic contains unexpected information based on the degree of trust for the network element; providing results with respect to whether the traffic contains unexpected information to a human expert interface based on the degree of trust for the network element; selecting traffic for monitoring using rules that are based on network element trust information; and selecting some of the traffic that was monitored for examination based on a degree of trust for the network element; wherein monitoring traffic further comprises: specifying the traffic to be monitored based on traffic classification; examining the traffic that was monitored and was selected using rules using a level of examination selected from a plurality of levels of examination to determine whether the traffic contains unexpected information based on the degree of trust for the network element; and providing results with respect to whether the traffic that was monitored and was selected using rules contains unexpected information to the human expert interface based on the degree of trust for the network element; wherein the level of examination of the traffic that was monitored and was selected using rules is based on the degree of trust for the network element.
Claim 13
Independent Claim
404 words
A system, comprising: a processor; and a memory coupled to the processor and comprising computer readable program code embodied in the memory that when executed by the processor causes the processor to perform operations comprising: generating a first hash value based on data associated with the network element wherein the first hash value is based on a configuration of the network element at a first time and the first hash value is an acceptable result for the configuration of the network element; generating a second hash value based on the data associated with the network element wherein the second hash value is based on a configuration of the network element at a second time different than the first time; comparing the first hash value with the second hash value to determine whether the network element can be trusted based on whether a change has occurred in the configuration of the network between the first time and the second time; monitoring traffic associated with the network element based on whether the network element can be trusted; and selecting some of the traffic that was monitored to be blocked based on the degree of trust for the network element; wherein monitoring traffic comprises: monitoring the traffic using rules to determine if the traffic contains unexpected information based on the degree of trust for the network element; providing results with respect to whether the traffic contains unexpected information to a human expert interface based on the degree of trust for the network element; selecting traffic for monitoring using rules that are based on network element trust information; and selecting some of the traffic that was monitored for examination based on a degree of trust for the network element; wherein monitoring traffic further comprises: specifying the traffic to be monitored based on traffic classification; examining the traffic that was monitored and was selected using rules using a level of examination selected from a plurality of levels of examination to determine whether the traffic contains unexpected information based on the degree of trust for the network element; and providing results with respect to whether the traffic that was monitored and was selected using rules contains unexpected information to the human expert interface based on the degree of trust for the network element; wherein the level of examination of the traffic that was monitored and was selected using rules is based on the degree of trust for the network element.
Claim 14
Dependent Claim
47 words
The system of claim 11 , wherein comparing the first hash value with the second hash value to determine whether the network element can be trusted comprises comparing the first hash value with the second hash value to determine a degree of trust for the network element.
Claim 15
Dependent Claim
28 words
The system of claim 11 , wherein monitoring traffic further comprises: specifying the traffic to be monitored based on one of a time duration and a traffic amount.
Claim 16
Dependent Claim
36 words
The system of claim 11 , wherein monitoring the traffic further comprises: obtaining input via the human expert interface; and revising the results with respect to whether the traffic contains unexpected information based on the input.
Claim 17
Dependent Claim
51 words
The system of claim 11 , wherein the operations further comprise: examining the some of the traffic that was monitored using one of rules, pattern matching techniques, and deviation from expected values techniques to determine if the traffic contains unexpected information based on the degree of trust for the network element.
References Cited (Backward Citations)
US7201662B2
Cited
US20030216172A1
Cited
US20020059528A1
Cited
US20020133586A1
Cited
US7275102B2
Cited
US7299277B1
Cited
US20030182421A1
Cited
US20040044727A1
Cited
US7263560B2
Cited
US20040064568A1
Cited
US7206934B2
Cited
US20040064512A1
Cited
US20040064693A1
Cited
US20040177120A1
Cited
US7024548B1
Cited
US20050005154A1
Cited
US20050071644A1
Cited
US20080028224A1
Cited
US20080010377A1
Cited
US20070168292A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2018-03-09 | 2018-09-08 | 2019-03-10 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2022-03-09 | 2022-09-08 | 2023-03-10 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2026-03-09 | 2026-09-08 | 2027-03-10 | $7700.00 | Surcharge Window Open |