Methods and systems for transferring packets and preventing illicit access
AssigneeKabushiki Kaisha Toshiba
InventorMasamichi Tateoka
Life of this patent
Estimating the term…
Abstract
A packet sending mechanism which has received a packet from a packet identifier adding mechanism sends the packet on the basis of preset information and determines whether the packet is related to an illicit access.
Claims19
A packet transfer apparatus which is connected to at least first and second network segments and, when packets to be transferred between the first and second network segments include a packet for causing an illicit access, excludes the illicit packet, comprising:
- receiving means for receiving a packet from the first network segment;
- identifier adding means for adding an identifier to the received packet received by said receiving means;
- a packet hold queue for temporarily holding the received packet having the added identifier;
- packet analyzing means for determining whether the received packet is a packet related to an illicit access including a known preset operation error condition, and upon determining that the received packet is not the packet related to the illicit access, outputting the identifier of the received packet;
- and
- sent packet holding means for holding a sent packet that was previously sent to the second network segment, before determining whether the received packet relates to the illicit access, for which said packet analyzing means determines that the packet is not the packet related to the received illicit access,
- wherein in analyzing the received packet, said packet analyzing means looks up the sent packet held by said sent packet holding means and determines whether or not a combination of the received packet and the sent packet includes a factor that causes an operation error when software in the apparatus connected to the second network segment is executed sending means for receiving the identifier output from said packed analyzing means, extracting the received packet having the received identifier from said packed hold queue, and sending the received packet to the second network segment.
A packet transfer apparatus which is connected to at least first and second network segments and, when packets to be transferred between the first and second network segments include a packet for causing an illicit access, excludes the illicit packet, comprising:
- receiving means for receiving a packet from the first network segment;
- identifier adding means for adding an identifier to the received packet received by said receiving means;
- a packet hold queue for temporarily holding the received packet having the added identifier;
- packet analyzing means for determining whether the received packet is a packet related to an illicit access including a known preset operation error condition, and upon determining that the received packet is not the packet related to the illicit access, outputting the identifier of the received packet,
- wherein said packet analyzing means comprises:
- packet storage means for storing the received packet having the added identifier output from said packet queue;
- program storage means for storing a packet analysis program which includes character strings contained in the packet related to the illicit access;
- and
- program executing means for executing the packet analysis program determining whether the received packet stored in said packet storage means is the packet related to the illicit access containing the known operation error condition, and upon determining that the received packet is not the packet related to the illicit access, outputting the identifier of the received packet;
- sending means for receiving the identifier output from said packet analyzing means, extracting the received packet having the received identifier from said packet hold queue, and sending the received packet to the second network segment;
- and
- analysis program updating means for updating the packet analysis program stored in said program storage means.
A packet transfer method for a packet transfer apparatus which is connected to at least first and second network segments and, when packets to be transferred between the first and second network segments include a packet for causing an illicit access, excludes the illicit packet, comprising:
- receiving a packet from the first network segment;
- adding an identifier to the received packet;
- temporarily holding the received packet having the added identifier;
- analyzing the received packet having the added identifier, determining that the received packet is not a packet related to an illicit access, by executing a packet analysis program and outputting the identifier of the received packet determined as a normal packet;
- receiving the identifier, extracting the received packet having the received identifier from the received packets temporarily held, and sending the received packet to the second network segment;
- wherein the packet analysis program is updated upon receiving an update instruction from one of a serial interface, the network interface, and an independent network interface when it is identified that the received update instruction satisfies a specific format.
In an apparatus that connects to at least first and second network segments and, when packets to be transferred between the first and second network segments include a packet for causing an illicit access, excludes the illicit packet, a method comprising:
- receiving a packet from the first network segment;
- adding an identifier to the received packet;
- temporarily holding the received packet having the added identifier;
- and a sent packet that was previously sent to the second network segment;
- determining whether the received packet is a packet related to an illicit access including a known preset operation error condition, and upon determining that the received packet is not the packet related to the illicit access, outputting the identifier of the received packet;
- wherein determining the illicit packet includes determining whether or not a combination of the received packet and the sent packet includes a factor that may cause an operation error when software in the apparatus connected to the second network segment is executed;
- receiving the output identifier of the received packet, extracting the received packet having the received added identifier from said packet hold queue, and sending the received packet to the second network segment.
A computer-readable medium containing instructions for controlling an apparatus to perform a method, the apparatus being connected to at least first and second network segments and, when packets to be transferred between the first and second network segments include a packet for causing an illicit access, excluding the illicit packet, the method comprising:
- receiving a packet from the first network segment;
- adding an identifier to the received packet;
- temporarily holding the received packet having the added identifier;
- and a sent packet that was previously sent to the second network segment;
- determining whether the received packet is a packet related to an illicit access including a known preset operation error condition, and upon determining that the received packet is not the packet related to the illicit access, outputting the identifier of the received packet;
- wherein determining the illicit packet includes determining whether or not a combination of the received packet and the sent packet includes a factor that may cause an operation error when software in the apparatus connected to the second network segment is executed;
- receiving the output identifier of the received packet, extracting the received packet having the received output identifier from said packet hold queue, and sending the received packet to the second network segment.
A computer-readable medium containing instructions for controlling an apparatus to perform a method, the apparatus being connected to at least first and second network segments and, when packets to be transferred between the first and second network segments include a packet for causing an illicit access, excluding the illicit packet, the method comprising:
- receiving a packet from the first network segment;
- adding an identifier to the received packet;
- temporarily holding the received packet having the added identifier;
- analyzing the received packet having the added identifier, determining that the received packet is not a packet related to an illicit access, by executing a packet analysis program and outputting the identifier of the received packet determined as a normal packet;
- receiving the identifier, extracting the received packet having the received identifier from the received packets temporarily held, and sending the received packet to the second network segment;
- wherein the packet analysis program is updated upon receiving an update instruction from one of a serial interface, the network interface, and an independent network interface when it is identified that the received update instruction satisfies a specific format.
Dependencies are inferred from the claim text.