US 7,924,850 B2Granted

System and method for managing and controlling communications performed by a computer terminal connected to a network

AssigneeInternational Business Machines Corporation

InventorsKentaro Aoki, Yukinobu Moriya, Katsuhiko Shimada, Naoto Shimizu, Hideki Sugiyama

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present invention provides a system which maintains a function of monitoring and controlling a network regardless of an increase of data to be downloaded by a computer whose access to the network is restricted. The system includes: a first interface for transmitting and receiving data to and from the network; a second interface for transmitting and receiving data to and from the network; a determination component for determining whether or not network data received by the first interface is from a first terminal device; a first creation component for creating, in response to a determination made by the determination component that the network data is transmitted from the first terminal device, information causing a transmission destination address of the network data to be changed to an address of the second interface in a table of the first terminal device; a first transmission component for transmitting the information causing the transmission destination address to be changed to the address of the second interface; and a restriction component for restricting a bandwidth of the network data passing through the second interface to a predetermined value.

Claims3

Dependent claims

A method of controlling access to a network from a computer terminal, comprising:

capturing a first packet from a switching hub by a first interface;
determining whether the captured first packet is transmitted from a first terminal or a second terminal;
in response to determining that the captured first packet is a security setting violation report packet transmitted from the first terminal, generating and sending a first address resolution protocol information, changing a first media access control address for a security patch download server of a first address resolution protocol table of the first terminal into a second media access control address of a second interface, and changing a third media access control address into the first media access control address;
in response to determining that the captured first packet is a second address resolution protocol packet transmitted from the second terminal, generating and sending a second address resolution protocol information and changing a fourth media access control address of a second address resolution protocol table of the second terminal into the first media access control address;
capturing a second packet at the second interface;
determining whether the captured second packet at the second interface is related to a security patch of a first server;
redirecting the captured second packet at the second interface related to the security patch of the first server without bandwidth control;
determining whether the captured second packet at the second interface is related to a security patch of a second server;
redirecting the captured second packet at the second interface related to the security patch of the second server with bandwidth control;
discarding a captured second packet at the second interface unrelated to the security patch of the second server;
and
disposing the captured first packet from the first terminal and the second terminal that passes through the first interface,
wherein the first terminal is a security setting violation terminal, and the second terminal is an illegal connection terminal.

10 more elements

A method of controlling access to a network from a computer terminal, comprising:

capturing a first packet from a switching hub by a first interface;
determining whether the captured first packet is transmitted from a first terminal or a second terminal;
in response to determining that the captured first packet is a security setting violation report packet transmitted from the first terminal, generating and sending a first address resolution protocol information for changing a first media access control address for a security patch download server of the first address resolution protocol table of the first terminal into a second media access control address of a second interface, and for changing a third media access control address of the third interface into the first media access control address;
in response to determining that the captured first packet is a second address resolution protocol packet transmitted from the second terminal according to the step of determination, generating and sending second address resolution protocol information for changing the second media access control address of the second address resolution protocol table of the second terminal into the third media access control address of the third interface;
capturing a second packet at the second interface;
determining whether the captured second packet at the second interface is related to a security patch of a first transmission control protocol port;
redirecting the captured second packet at the second interface related to the security patch of the first transmission control protocol port without bandwidth control;
determining whether the captured second packet at the second interface is related to a security patch of a second transmission control protocol port;
redirecting the captured second packet at the second interface related to the security patch of the second transmission control protocol port with bandwidth control;
discarding a captured second packet at the second interface unrelated to the security patch of the second transmission control protocol port;
and
disposing the captured first packet from the first terminal and the second terminal that passes through the third interface,
wherein the first terminal is a security setting violation terminal, and the second terminal is an illegal connection terminal.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/860,758Filed 25 Sep 2007
Priority: JP 2006-2732614 Oct 2006
Published: US 2008/0084820 A110 Apr 2008
Granted: 12 Apr 2011
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 61/103
Of different types: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
H04L 67/60
Network services: scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the…
H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms