US 2017/0257398 A1 · IPS SWITCH SYSTEM AND PROCESSING METHOD

Abstract

An intrusion protection system (IPS) switch system forwards traffic inserted from a switch to a destination port, simultaneously copying and storing the traffic output to an internal port by a port mirroring method of the switch, detecting maleficence inspection of the stored packet based on a protocol/pattern, providing a blocking control policy (e.g., Access Control List (ACL)) to an output port of the switch based on IP or MAC information of the terminal detected of maleficence to prevent expansion of maleficent packets, and transmitting traffic whose destination is outside to the IPS processor to transmit only normal packets to the outside after detecting/blocking maleficence based on the protocol/pattern, and a processing method thereof

Claims9

Dependent claims

An intrusion protection system (IPS) switch system, comprising:

a switching processor for switching an inserted packet to output it to a destination port, mirroring the traffic output to an internal port to transmit it to the following packet storing processor, and transmitting the traffic output to an external port to the following IPS processor;
a packet storing processor for storing packets registered as suspicious internet protocol (IP) in the traffic mirrored in the switching processor and other packets separately;
and
an IPS processor for blocking a packet whose maleficence has been confirmed by performing security inspection based on a protocol and pattern with respect to the packets stored in the packet storing processor and providing a blocking control policy to an output port based on the internet protocol (IP) and media access control (MAC) to the switching processor to block an internal terminal determined to be maleficent.

1 more element

A method for processing an intrusion protection system (IPS) switch system, the method comprising:

(A) a switching processor determining whether the destination is the inside or outside when a packet is input from the inside;
(B) as a result of determination, the switching processor outputting to an internal port when the destination is the inside, and mirroring the output packet and transmitting it to a packet storing processor;
(C) an IPS processor performing total internal threat detection and blocking when the packet transmitted to the packet storing processor matches the suspicious internet protocol (IP);
and
(D) the IPS processor performing maleficence inspection by sample internal threat detection when the packet transmitted to the packet storing processor does not match the suspicious IP.

2 more elements

Dependencies are inferred from the claim text.

Ips switch system and processing method

Life of this patent

Ips switch system and processing method

Life of this patent

Abstract

Claims9