Back to results
US 10,944,792 B2Granted
Methods and systems for protecting a secured network
AssigneeCentripetal Networks, Inc.
InventorsSteven Rogers, Sean Moore, David K. Ahn, Peter P. Geremia
Life of this patent
Estimating the term…
Abstract
Methods and systems for protecting a secured network are presented. For example, one or more packet security gateways may be associated with a security policy management server. At each packet security gateway, a dynamic security policy may be received from the security policy management server, packets associated with a network protected by the packet security gateway may be received, and at least one of multiple packet transformation functions specified by the dynamic security policy may be performed on the packets.
Claims20
A method comprising:
- receiving, by at least one packet security gateway, a plurality of packets associated with a network protected by the at least one packet security gateway;
- identifying, by the packet security gateway and on a packet-by-packet basis, one or more of the plurality of packets comprising at least one first packet-identification criteria;
- performing, by the packet security gateway and on a packet-by-packet basis, a packet digest logging function on each of the one or more packets comprising the at least one first packet-identification criteria, wherein the packet digest logging function is performed based on a security policy comprising at least one rule specifying the at least one first packet-identification criteria, and wherein the performing the packet digest logging function comprises:
- identifying a subset of information specified by the packet digest logging function for each of the one or more packets comprising the at least one first packet-identification criteria;
- generating, based on the one or more packets comprising the at least one first packet-identification criteria, a record comprising the subset of information specified by the packet digest logging function;
- and
- transmitting, to a server, the record comprising the subset of information specified by the packet digest logging function;
- and
- routing, to a monitoring device and on a packet-by-packet basis, the one or more packets comprising the at least one first packet-identification criteria after the performing the packet digest logging function.
6 more elements
A method comprising:
- receiving, by a packet security gateway of a plurality of packet security gateways, packets associated with a network protected by the packet security gateway;
- identifying, by the packet security gateway, from amongst the packets associated with the network protected by the packet security gateway, and on a packet-by-packet basis, one or more packets corresponding to at least one first packet-identification criteria, wherein the at least one first packet-identification criteria comprises a Differentiated Service Code Point (DSCP) selector;
- performing, by the packet security gateway and on a packet-by-packet basis, a packet digest logging function on each of the one or more packets corresponding to the at least one first packet-identification criteria comprising the DSCP selector, wherein the packet digest logging function is performed based on a security policy comprising at least one rule specifying the at least one first packet-identification criteria, and wherein the performing the packet digest logging function comprises:
- identifying a subset of information specified by the packet digest logging function for each of the one or more packets comprising the at least one first packet-identification criteria comprising the DSCP selector;
- generating, based on the one or more packets comprising the at least one first packet-identification criteria, a record comprising the subset of information specified by the packet digest logging function;
- and
- transmitting, to a server and for each of the one or more packets comprising the at least one first packet-identification criteria, the record comprising the subset of information specified by the packet digest logging function;
- and
- routing, to a monitoring device and on a packet-by-packet basis, the one or more packets comprising the at least one first packet-identification criteria for monitoring in response to the performing the packet digest logging function.
6 more elements
A method comprising:
- receiving, by at least one packet security gateway, a plurality of packets associated with a network protected by the at least one packet security gateway;
- identifying, by the packet security gateway and on a packet-by-packet basis, a rule corresponding to each of the plurality of packets based on at least one packet-identification criteria associated with each of the plurality of packets;
- and
- performing, by the packet security gateway and on a packet-by-packet basis, one of a plurality of packet transformation functions on each of the plurality of packets based on the at least one packet-identification criteria associated with each or the plurality of packets, wherein the packet transformation functions comprise:
- a packet digest logging function comprising, on a packet-by-packet basis and for packets comprising at least one first packet-identification criteria, identifying a subset of information specified by the packet digest logging function, generating a record comprising the subset of information specified by the packet digest logging function, transmitting the record comprising the subset of information specified by the packet digest logging function to a server, and routing each of the one or more packets comprising the at least one first packet-identification criteria to a monitoring device,
- an accept packet transformation function comprising, on a packet-by-packet basis and for each packet comprising at least one second packet-identification criteria, forwarding, by the packet security gateway, each of the one or more packets comprising the at least one second packet-identification criteria toward their respective destinations, and
- a deny packet transformation function comprising, on a packet-by-packet basis and for each packet comprising at least one third packet-identification criteria, dropping, by the packet security gateway, each of the one or more packets comprising the at least one third packet-identification criteria.
4 more elements
Dependencies are inferred from the claim text.