# US 11,310,206 B2 · In-line cognitive network security plugin device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,206 B2 - Document ID: US11310206B2 - Status: Granted - Kind: B2 - Application number: 16/532,589 - Filed: 2019-08-06 - Published: 2021-02-11 - Granted: 2022-04-19 - Earliest claimed: 2019-08-06 - Assignees: Kyndryl, Inc. - Applicants: Kyndryl, Inc. - Inventors: Joseph Reyes; Bernhard Julius Klingenberg; Hamza Yaswi - Web page: https://patentgrep.com/patent/US11310206B2 ## CPC - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - G06F 21/564: {by virus signature recognition} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and computer program products providing network security leveraging analytics and physical separation between computer systems and a network to prevent threats from infecting network devices. A specialized pluggable dongle like security device is inserted between ports of computer system(s) connecting to the network and port(s) of network hardware facilitating connections between the computer system and computer network. The security device uses a combination of onboard analytics and cloud-based analytic services to detect incoming threats from network traffic and whether to allow network traffic to pass through the security device and/or prevent network traffic from entering the computer system. In response to detected network threats, an out of band management network communicating with the security device can open or close a physical gate onboard the security device, which, when opened introduces an air gap between the network and computer system, preventing harmful network traffic from entering the computer system. ## Claims ### Claim 1 A computer-implemented method comprising: connecting a security device inline between a first port placed in communication with a network computer system and a second port placed in communication with network hardware of a computer network; intercepting, by the security device, network traffic of the computer network flowing from the network hardware to the network computer system; analyzing the network traffic intercepted by the security device for a threat level of the network traffic exceeding a pre-set safe level; modulating a gate of the security device as a function of the threat level, wherein opening the gate in response to security threat creates an air gap preventing network traffic from passing from the second port through the security device to the first port in communication with the network computer system; determining, by the security device, that the threat level of the network traffic exceeds the pre-set safe level; further determining, by the security device, that the threat level of the network traffic is less than a maximum threat level or maximum threat level range set by the security device; buffering the network traffic received by the security device in an on-board buffer, preventing the network traffic from entering the network computer system; and in response to said buffering, opening or closing the gate. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: determining, by the security device, that the threat level of the network traffic meets or is below the pre-set safe level; and modulating the gate of the security device to a closed position, allowing the network traffic to pass from the second port through the security device to the first port in communication with the network computer system. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: determining, by the security device, that the threat level of the network traffic exceeds the pre-set safe level; further determining, by the security device, that the threat level of the network traffic meets or exceeds a maximum threat level or a maximum threat level range set by the security device; and in response to determining the threat level meets or exceeds the maximum threat level or the maximum threat level range set by the security device, modulating the gate of the security device to an open position, creating an air gap between the first port and the second port, preventing the network traffic from passing through the security device to the network computer system. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, said method further comprising: prior to said opening or closing the gate, transmitting metadata or compressed data of the network traffic to cloud-based analytics determining a correlation between a threat posed by the network traffic and known threats to computer systems; and receiving from the cloud-based analytics, a decision to modulate the gate of the security device into an open or closed position as a function of the correlation between the threat posed by the network traffic and the known threats to the computer systems, wherein opening the gate creates an air gap between the second port and the first port, preventing the network traffic from passing from the network hardware through the security device and to the network computer system and closing the gate releases the network traffic from the buffer, allowing the network traffic to pass through the security device and to the network computer system. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the security device is part of a network of security devices comprising a plurality of security devices analyzing the network traffic intercepted by each security device within the network of security devices for threat levels exceeding the pre-set safe level, and the analysis of the network traffic performed by each security device within the network of security devices is shared amongst the network of security devices. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the security device is a pluggable dongle, and the gate is a physical gate or logical gate. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the step of modulating the gate of the security device as a function of the threat level is managed by an out-of-band management network connected to the security device. ### Claim 8 A computer system comprising: a security device connected inline between a first port placed in communication with a network computer system and a second port placed in communication with network hardware of a computer network; at least one processor placed in electronic communication with the security device; and a computer-readable storage media coupled to the at least one processor, wherein the computer-readable storage media contains program instructions executing a computer-implemented method comprising: intercepting, by the security device, network traffic of the computer network flowing from the network hardware to the network computer system, analyzing the network traffic intercepted by the security device for a threat level exceeding a pre-set safe level, modulating a gate of the security device as a function of the threat level, wherein opening the gate in response to security threat creates an air gap preventing network traffic from passing from the second port through the security device to the first port in communication with the network computer system; determining, by the security device, that the threat level of the network traffic exceeds the pre-set safe level; further determining, by the security device, that the threat level of the network traffic is less than a maximum threat level or maximum threat level range set by the security device; buffering the network traffic received by the security device in an on-board buffer, preventing the network traffic from entering the network computer system; and in response to said buffering, opening or closing the gate. ### Claim 9 (depends on 8) The computer system of claim 8, further comprising: determining, by the security device, that the threat level of the network traffic meets or is below the pre-set safe level; and modulating the gate of the security device to a closed position, allowing the network traffic to pass from the second port through the security device to the first port in communication with the network computer system. ### Claim 10 (depends on 8) The computer system of claim 8, further comprising: determining, by the security device, that the threat level of the network traffic exceeds the pre-set safe level; further determining, by the security device, that the threat level of the network traffic meets or exceeds a maximum threat level or maximum threat level range set by the security device; and in response to determining the threat level meets or exceeds the maximum threat level or the maximum threat level range set by the security device, modulating the gate of the security device to an open position, creating the air gap between the first port and the second port, preventing the network traffic from passing through the security device to the network computer system. ### Claim 11 (depends on 8) The computer system of claim 8, further comprising: prior to said opening or closing the gate, transmitting metadata or compressed data of the network traffic to a cloud-based analytics determining a correlation between a threat of the network traffic and known threats to computer systems; and receiving from the cloud-based analytics, a decision to modulate the gate of the security device into an open or closed position as a function of the correlation between the threat of the network traffic and the known threats to the computer systems, wherein opening the gate creates an air gap between the second port and the first port, preventing the network traffic from passing from the network hardware through the security device and to the network computer system and closing the gate releases the network traffic from the buffer, allowing the network traffic to pass through the security device and to the network computer system. ### Claim 12 (depends on 8) The computer system of claim 8, wherein the security device is part of a network of security devices comprising a plurality of security devices analyzing the network traffic intercepted by each security device within the network of security devices for threat levels exceeding the pre-set safe level, and the analysis of the network traffic performed by each security device within the network of security devices is shared amongst the network of security devices. ### Claim 13 (depends on 8) The computer system of claim 8, wherein the security device is a pluggable dongle, and the gate is a physical gate or logical gate. ### Claim 14 (depends on 8) The computer system of claim 8, wherein the step of modulating the gate of the security device as a function of the threat level is managed by an out-of-band management network connected to the security device. ### Claim 15 A computer program product comprising: one or more computer-readable storage media having computer-readable program instructions stored on the one or more computer-readable storage media, said program instructions executes a computer-implemented method comprising: intercepting, by a security device connected inline between a first port placed in communication with a network computer system and a second port placed in communication with network hardware of a computer network, network traffic of the computer network flowing from the network hardware to the network computer system; analyzing the network traffic intercepted by the security device for a threat level exceeding a pre-set safe level; modulating a gate of the security device as a function of the threat level, wherein opening the gate in response to security threat creates an air gap preventing network traffic from passing from the second port through the security device to the first port in communication with the network computer system; determining, by the security device, that the threat level of the network traffic exceeds the pre-set safe level; further determining, by the security device, that the threat level of the network traffic is less than a maximum threat level or maximum threat level range set by the security device; buffering the network traffic received by the security device in an on-board buffer, preventing the network traffic from entering the network computer system; and in response to said buffering, opening or closing the gate. ### Claim 16 (depends on 15) The computer program product of claim 15, further comprising: determining, by the security device, that the threat level of the network traffic meets or is below the pre-set safe level; and modulating the gate of the security device to a closed position, allowing the network traffic to pass from the second port through the security device and through the first port into to the network computer system. ### Claim 17 (depends on 15) The computer program product of claim 15, further comprising: determining, by the security device, that the threat level of the network traffic exceeds the pre-set safe level; further determining, by the security device, that the threat level of the network traffic meets or exceeds a maximum threat level or maximum threat level range set by the security device; and in response to determining the threat level meets or exceeds the maximum threat level or the maximum threat level range set by the security device, modulating the gate of the security device to an open position, creating the air gap and preventing the network traffic from passing through the security device to the network computer system. ### Claim 18 (depends on 15) The computer program product of claim 15, further comprising: prior to said opening or closing the gate, transmitting metadata or compressed data of the network traffic to a cloud-based analytics determining a correlation between a threat of the network traffic and known threats to computer systems; and receiving from the cloud-based analytics, a decision to modulate the gate of the security device into an open or closed position as a function of the correlation between the threat of the network traffic and the known threats to the computer systems, wherein opening the gate creates an air gap between the second port and the first port, preventing the network traffic from passing from the network hardware through the security device and to the network computer system and closing the gate releases the network traffic from the buffer, allowing the network traffic to pass through the security device and to the network computer system. ### Claim 19 (depends on 15) The computer program product of claim 15, wherein the security device is part of a network of security devices comprising a plurality of security devices analyzing the network traffic intercepted by each security device within the network of security devices for threat levels exceeding the pre-set safe level, and the analysis of the network traffic performed by each security device within the network of security devices is shared amongst the network of security devices. ### Claim 20 (depends on 15) The computer program product of claim 15, wherein the security device is a pluggable dongle, and the gate is a physical gate or logical gate.