# US 11,310,242 B2 · System and method for protecting network-facing services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,242 B2 - Document ID: US11310242B2 - Status: Granted - Kind: B2 - Application number: 16/248,211 - Filed: 2019-01-15 - Published: 2020-07-16 - Granted: 2022-04-19 - Earliest claimed: 2019-01-15 - Assignees: Raytheon BBN Technologies Corp. - Applicants: Raytheon BBN Technologies Corp. - Inventors: Nathaniel Benjamin Soule; Partha Pal; Aaron Paulos - Web page: https://patentgrep.com/patent/US11310242B2 ## CPC - H04L 63/105: {Multiple levels of security} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 63/101: {Access control lists [ACL]} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1458: {Denial of Service} - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system for performing security functions in a service-oriented computer system includes a router node configured to forward at least one packet of at least one service request to at least one server computer adapted to process the at least one service request; a first server node configured to execute, for the at least one packet, a first protocol layer of a network protocol stack, determine whether the at least one packet is compliant at the first protocol layer, and provide the at least one packet to a second server node responsive to determining that the at least one packet is compliant at the first protocol layer. The second server node is configured to execute, for the at least one packet, a second protocol layer of the network protocol stack, and determine whether the at least one packet is compliant at the second protocol layer. ## Claims ### Claim 1 A system for performing security functions in a service-oriented computer system, the system comprising: a router node configured to receive at least one service request and to forward at least one packet of the at least one service request to at least one server computer adapted to process the at least one service request; a first server node having a first processor configured to execute, for the at least one packet, a first protocol layer of a network protocol stack, determine whether the at least one packet is compliant at the first protocol layer, and provide the at least one packet to a second server node responsive to determining that the at least one packet is compliant at the first protocol layer; and the second server node having a second processor configured to execute, for the at least one packet, a second protocol layer of the network protocol stack, and determine whether the at least one packet is compliant at the second protocol layer. ### Claim 2 (depends on 1) The system of claim 1, wherein the second processor of the second server node is configured to provide the at least one packet to the at least one server computer responsive to determining that the at least one packet is compliant at the second protocol layer. ### Claim 3 (depends on 1) The system of claim 1, wherein the network protocol stack is an internet protocol suite, and the first protocol layer is lower in the internet protocol suite than the second protocol layer. ### Claim 4 (depends on 3) The system of claim 3, wherein at least one of the first protocol layer and second protocol layer is an internet layer using a protocol selected from a group consisting of internet protocol (IP) and internet control message protocol (ICMP). ### Claim 5 (depends on 3) The system of claim 3, wherein at least one of the first protocol layer and second protocol layer is a transport layer using a protocol selected from a group consisting of transmission control protocol (TCP) and user datagram protocol (UDP). ### Claim 6 (depends on 3) The system of claim 3, wherein at least one of the first protocol layer and second protocol layer is an application layer using a protocol selected from a group consisting of hypertext transfer protocol (HTTP), HTTP/2, secure file transfer protocol (SFTP), domain name system (DNS), and transport layer security (TLS). ### Claim 7 (depends on 1) The system of claim 1, wherein at least one of the first processor and the second processor is configured to determine whether the at least one packet is compliant with reference to at least one of a white list, a black list, and a rule relating to one of at least the first protocol layer and the second protocol layer. ### Claim 8 (depends on 1) The system of claim 1, wherein at least one of the first processor and the second processor is configured, responsive to determining that the at least one packet is non-compliant at the first protocol layer or the second protocol layer, to take at least one action selected from a group consisting of blocking a sender of the at least one service request, sending a deceptive response to the sender of the at least one packet, modifying the at least one packet, dropping the at least one packet, delaying delivery of the at least one packet, and redirecting the at least one packet. ### Claim 9 (depends on 1) The system of claim 1, wherein the first server node is a member of a first tier of server nodes each configured to execute the first protocol layer of the network protocol stack, and wherein the second server node is a member of a second tier of server nodes each configured to execute a second protocol layer of the network protocol stack. ### Claim 10 (depends on 9) The system of claim 9, wherein the router node is further configured to: determine, for the at least one packet, a route through the first tier of server nodes and the second tier of server nodes; select the first server node from the first tier of server nodes based on the route; and select the second server node from the second tier of server nodes based on the route. ### Claim 11 (depends on 10) The system of claim 10, wherein the route is determined to optimize load balancing for the first tier of server nodes. ### Claim 12 (depends on 1) The system of claim 1, wherein at least one of the first processor of the first server node and the second processor of the second server node is further configured to execute, for the at least one packet, a third protocol layer of a network protocol stack. ### Claim 13 A method for performing security functions in a service-oriented computer system, the method comprising: intercepting at least one packet of at least one service request directed to at least one server computer adapted to process the at least one service request; executing, at a first server node, a first protocol layer of a network protocol for the at least one packet; determining whether the at least one packet is compliant at the first protocol layer; providing the at least one packet to a second server node responsive to determining that the at least one packet is compliant at the first protocol layer; executing, at the second server node, a second protocol layer of the network protocol for the at least one packet; and determining whether the at least one packet is compliant at the second protocol layer. ### Claim 14 (depends on 13) The method of claim 13, further comprising providing the at least one packet to the at least one server computer responsive to determining that the at least one packet is compliant at the second protocol layer. ### Claim 15 (depends on 13) The method of claim 13, wherein the network protocol stack is an internet protocol suite, and the first protocol layer is lower in the internet protocol suite than the second protocol layer. ### Claim 16 (depends on 15) The method of claim 15, wherein at least one of the first protocol layer and second protocol layer is an internet layer using a protocol selected from a group consisting of internet protocol (IP) and internet control message protocol (ICMP). ### Claim 17 (depends on 15) The method of claim 15, wherein at least one of the first protocol layer and second protocol layer is a transport layer using a protocol selected from a group consisting of transmission control protocol (TCP) and user datagram protocol (UDP). ### Claim 18 (depends on 15) The method of claim 15, wherein at least one of the first protocol layer and second protocol layer is an application layer using a protocol selected from a group consisting of hypertext transfer protocol (HTTP), HTTP/2, secure file transfer protocol (SFTP), domain name system (DNS), and transport layer security (TLS). ### Claim 19 (depends on 13) The method of claim 13, further comprising, responsive to determining that the at least one packet is non-compliant at the first protocol layer or the second protocol layer, taking at least one action selected from a group consisting of blocking a sender of the at least one service request, sending a deceptive response to the sender of the at least one packet, modifying the at least one packet, dropping the at least one packet, delaying delivery of the at least one packet, and redirecting the at least one packet. ### Claim 20 (depends on 13) The method of claim 13, further comprising executing, for the at least one packet, a third protocol layer of a network protocol stack.