# US 2013/0160118 A1 · Methods, Communication Networks, and Computer Program Products for Monitoring, Examining, and/or Blocking Traffic Associated with a Network Element Based on Whether the Network Element Can be Trusted > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160118 A1 - Document ID: US20130160118A1 - Status: Published application - Kind: A1 - Application number: 13/769,693 - Filed: 2013-02-18 - Published: 2013-06-20 - Earliest claimed: 2005-12-22 - Assignees: AT&T Intellectual Property I, L.P. - Inventors: Jeffrey A. Aaron; Edgar Vaughan Shrum, JR. - Web page: https://patentgrep.com/patent/US20130160118A1 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/0263: {Rule management} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/1057: {involving pre-assessment of levels of reputation of peers} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A communication network is operated by determining whether a network element can be trusted and monitoring traffic associated with the network element based on whether the network element can be trusted. At least some of the monitored traffic may be selected for examination based on the degree of trust for the network element. At least some of the monitored and/or examined traffic is selected to be blocked based on the degree of trust for the network element. ## Claims ### Claim 1 A method of operating a communication network, comprising: determining whether a network element can be trusted, wherein determining whether a network element can be trusted comprises: generating a first hash value based on data associated with the network element wherein the first hash value is based on a configuration of the network element at a first time and the first hash value is an acceptable result for the configuration of the network element; generating a second hash value based on the data associated with the network element wherein the second hash value is based on a configuration of the network element at a second time different than the first time; and comparing the first hash value with the second hash value to determine whether the network element can be trusted; and monitoring traffic associated with the network element based on whether the network element can be trusted. ### Claim 2 (depends on 1) The method of claim 1, wherein comparing the first hash value with the second hash value to determine whether the network element can be trusted comprises comparing the first hash value with the second hash value to determine a degree of trust for the network element. ### Claim 3 (depends on 1) The method of claim 1, wherein monitoring traffic comprises: selecting traffic for monitoring using rules that are based on network element trust information. ### Claim 4 (depends on 3) The method of claim 3, wherein monitoring traffic further comprises: specifying the traffic to be monitored based on one of a traffic classification, a time duration, and a traffic amount. ### Claim 5 (depends on 3) The method of claim 3, wherein monitoring traffic further comprises: monitoring the traffic using one of rules, pattern matching techniques, and deviation from expected values techniques to determine if the traffic contains unexpected information based on a degree of trust for the network element; and providing results with respect to whether the traffic contains unexpected information to a human expert interface based on a degree of trust for the network element. ### Claim 6 (depends on 5) The method of claim 5, wherein monitoring the traffic traffic further comprises: obtaining input via the human expert interface; and revising the results with respect to whether the traffic contains unexpected information based on the input. ### Claim 7 (depends on 3) The method of claim 3, further comprising: selecting some of the traffic that was monitored for examination based on a degree of trust for the network element. ### Claim 8 (depends on 7) The method of claim 7, further comprising: examining the some of the traffic that was monitored using one of rules, pattern matching techniques, and deviation from expected values techniques to determine if the traffic contains unexpected information based on the degree of trust for the network element; and providing results with respect to whether the traffic that was monitored contains unexpected information to a human expert interface based on the degree of trust for the network element; wherein a level of examination of the some of the traffic that was monitored is based on the degree of trust for the network element. ### Claim 9 (depends on 8) The method of claim 8, wherein examining the some of the traffic that was monitored comprises: obtaining input via the human expert interface; and revising the results with respect to whether the some of the traffic that was monitored contains unexpected information based on the input. ### Claim 10 (depends on 7) The method of claim 7, further comprising: selecting some of the traffic that was monitored and examined to be blocked based on the degree of trust for the network element. ### Claim 11 (depends on 10) The method of claim 10, further comprising: blocking the some of the traffic to be blocked using filtering based on one of source address, destination address, port, protocol, and state of a connection. ### Claim 12 (depends on 11) The method of claim 11, wherein blocking the some of the traffic to be blocked comprises: obtaining input via the human expert interface; and permanently blocking the some of the traffic to be blocked based on the input. ### Claim 13 (depends on 10) The method of claim 10, further comprising: modifying rules, pattern matching techniques, and deviation from expected values techniques used in monitoring the traffic and examining the some of the traffic. ### Claim 14 (depends on 1) A method according to claim 1 wherein the network element is a communications device comprising one of a router, a gateway, a switching device, a cable modem, a digital subscriber line modem, a public switched telephone network modem, a wireless local area network modem, a wireless wide area network modem, a computer with a modem, a mobile terminal with a modem, a personal data assistant with a modem, and a cellular telephone with a modem. ### Claim 15 A communication network, comprising: a verification system that is to determine whether a network element can be trusted by: generating a first hash value based on data associated with the network element wherein the first hash value is based on a configuration of the network element at a first time and the first hash value is an acceptable result for the configuration of the network element; generating a second hash value based on the data associated with the network element wherein the second hash value is based on a configuration of the network element at a second time different than the first time; and comparing the first hash value with the second hash value to determine whether the network element can be trusted; and a monitor that is connected to the verification system and is to monitor traffic associated with the network element based on whether the network element can be trusted. ### Claim 16 (depends on 15) The communication network of claim 15, further comprising: a monitoring controller that is connected to the verification system and the monitor and is to select traffic for monitoring using rules that are based on the degree of trust for the network element. ### Claim 17 (depends on 16) The communication network of claim 16, further comprising: an examiner that is connected to the monitor and is to select some of the traffic that was monitored for examination based on the degree of trust for the network element. ### Claim 18 (depends on 17) The communication network of claim 17, further comprising: a blocking controller that is connected to the examiner and is to select some of the traffic that was monitored and examined to be blocked based on the degree of trust for the network element. ### Claim 19 (depends on 18) The communication network of claim 18, further comprising: a human expert interface; wherein the monitor is further to monitor the traffic using one of rules, pattern matching techniques, and deviation from expected values techniques to determine if the traffic contains unexpected information based on a degree of trust for the network element, and to provide results with respect to whether the traffic contains unexpected information to a human expert interface based on a degree of trust for the network element; and wherein the examiner is further configured to examine the some of the traffic that was monitored using one of rules, pattern matching techniques, and deviation from expected values techniques to determine if the traffic contains unexpected information based on the degree of trust for the network element, and to provide results with respect to whether the traffic that was monitored contains unexpected information to a human expert interface based on the degree of trust for the network element. ### Claim 20 (depends on 15) A communications network according to claim 15 wherein the network element is a communications device comprising one of a router, a gateway, a switching device, a cable modem, a digital subscriber line modem, a public switched telephone network modem, a wireless local area network modem, a wireless wide area network modem, a computer with a modem, a mobile terminal with a modem, a personal data assistant with a modem, and a cellular telephone with a modem.