US 7,073,196 B1Granted

Firewall for processing a connectionless network packet

AssigneeThe United States of America as represented by the National Security Agency

InventorsPatrick W. Dowd, John T. McHenry

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present invention is a device for and method of accessing a network by initializing a database, an approved list, and a disapproved list; receiving an connectionless network packet; computing a flow tag based on the connectionless network packet; discarding the connectionless network packet and returning to the second step if the flow tag is on the disapproved list; allowing access to the network and returning to the second step if the flow tag is on the approved list; comparing the flow tag to the database if the flow tag is not on the approved list or the disapproved list; discarding the connectionless network packet, adding the flow tag to the disapproved list, and returning to the second step if the database rejects the flow tag; and allowing access to the network, adding the flow tag to the approved list, and returning to the second step if the database accepts the flow tag.

Claims26

Dependent claims

A method of accessing an information processing network, comprising the steps of:

a) initializing a database, an approved list, and a disapproved list, where the database contains rules for allowing and denying access to the information processing network, where the approved list includes approvals of connectionless network packets, and where the disapproved list includes disapprovals of connectionless network packets;
b) receiving a connectionless network packet;
c) computing a flow tag based on the connectionless network packet;
d) discarding the connectionless network packet and returning to step (b) if the flow tag is on the disapproved list;
e) allowing the connectionless network packet access to the information processing network and returning to step (b) if the flow tag is on the approved list;
f) comparing the flow tag to the database if the flow tag is not on the approved list and is not on the disapproved list;
g) discarding the connectionless network packet, adding the flow tag to the disapproved list, and returning to step (b) if the database rejects the flow tag;
and
h) allowing the connectionless network packet access to the information processing network, adding the flow tag to the approved list, and returning to step (b) if the database accepts the flow tag.

6 more elements

A method of accessing an information processing network, comprising the steps of:

a) initializing a database, an approved list, and a disapproved list, where the database contains rules for allowing and denying access to the information processing network, where the approved list includes approvals of IP packets, and where the disapproved list includes disapprovals of IP packets;
b) receiving an IP packet;
c) computing a flow tag based on the IP packet;
d) discarding the IP packet and returning to step (b) if the flow tag is on the disapproved list;
e) allowing the IP packet access to the information processing network and returning to step (b) if the flow tag is on the approved list;
f) comparing the flow tag to the database if the flow tag is not on the approved list and is not on the disapproved list;
g) discarding the IP packet, adding the flow tag to the disapproved list, and returning to step (b) if the database rejects the flow tag;
and
h) allowing the IP packet access to the information processing network, adding the flow tag to the approved list, and returning to step (b) if the database accepts the flow tag.

6 more elements

Dependencies are inferred from the claim text.