Access control for networks

A computer program product comprising a computer readable medium on which is stored program instructions for a method, implemented on a dedicated network device which receives and transmits network traffic, the method limiting access to a local network, and comprising:

• receiving a packet at a network device;
• identifying an application associated with the packet;
• determining whether to examine the payload of the packet based on whether certain conditions are met;
• and
• examining the packet payload based on the determination.

A dedicated network device which receives and transmits network traffic and capable of controlling access to a local network, the network device comprising:

• multiple interfaces configured to connect with distinct networks or network segments;
• a memory or memories configured to store (i) one or more access control criteria for allowing or disallowing a packet based upon header information and (ii) information specifying an application conversation;
• and
• a processor configured to compare packet header information with the access control criteria and could determine whether to examine packet payloads based upon the context of the application conversation.

A method implemented on a computer or dedicated network device for controlling access to a local network, the method comprising:

• receiving a packet;
• determining whether the packet possesses a predefined source or destination address or port;
• determining whether the packet meets criteria for a current state of a TCP or UDP session with which it is associated;
• determining whether to examine the packet's payload based on whether certain conditions are met;
• and
• examining the packet's payload based on the determination.

A computer program product comprising a computer readable medium on which are stored computer program instructions for a method of controlling access to a local network, the computer program instructions specifying;

• receiving a packet;
• determining whether the packet possesses a predefined source or destination address or port;
• determining whether the packet meets criteria for a current state of a TCP or UDP session with which it is associated;
• determining whether to examine the packet's payload based on whether certain conditions are met;
• and
• examining the packet's payload based on the determination.