| Real time active network compartmentalization -> Monitor Keywords |
|
|
Real time active network compartmentalizationRelated Patent Categories: Information Security, Monitoring Or Scanning Of Software Or Data Including Attack Prevention, Intrusion DetectionReal time active network compartmentalization description/claimsThe Patent Description & Claims data below is from USPTO Patent Application 20070169196, Real time active network compartmentalization. Brief Patent Description - Full Patent Description - Patent Application Claims
CROSS-REFERENCE TO RELATED APPLICATIONS [0001] This application is a continuation of application Ser. No. 09/973,776 filed Oct. 11, 2001, which claims priority to U. S. Provisional Application No. 60/248,906 filed Nov. 15, 2000, both of which are hereby fully incorporated by reference. BACKGROUND OF THE INVENTION [0002] 1. Field of the Invention [0003] The present invention generally relates to digital communications networks and, more particularly, to the development of the properties of high levels of security and fault tolerance by active attack detection and real time establishment of compartmented security domains to permit network functionality in the presence of denial of service and other attacks. [0004] 2. Description of the Prior Art [0005] Numerous technical developments and economic forces have led to the widespread use of distributed data processing systems in which numerous data processors, each of which may be capable of functioning independently, are connected by a network in order to share both data and hardware and software resources. The connectivity of the system may be hard wired over a local or wide area network or may use links which are more or less accessible to the public, such as the Internet which utilizes many common carrier communication links which may be made available to a given processor through various hardware interfaces. When such technical capabilities such as the development of the TCP/IP protocol were being initially developed, however, flexibility of interconnectivity, scalability and ease and reliability of data exchange were of paramount importance and the importance of security measures was not fully appreciated and left to be implemented at individual processors or individual resources to prevent access from other connected processors. [0006] Of course, a given processor may be effectively connected to more than one network at a time and thus a publicly accessible network can be used to access another network, potentially through a sequence of processors. On the other hand, limiting access of processors to only secure or unsecure networks reduces functionality of the processor to levels which may be unacceptable due to the reduction of accessible resources. It is also in the versatile nature of data processors that any security feature that may be devised may also be defeated and protection of sensitive resources is entirely grounded in the difficulty of defeating the security measures utilized. Further, as alluded to above, restriction of access is usually provided only at individual processors or resources (e.g. applications) and not within the network, itself. [0007] As the use of TCP/IP networking has grown, techniques for exploiting a lack of security have been discovered, developed, implemented and widely shared in the hacker community worldwide. This circumstance presents a fundamental threat to the global network infrastructure that must be ameliorated if security of any network or connected resource is to be achieved. [0008] Accordingly, there are numerous reports of increasingly sophisticated intruder attacks on both military and commercial computer systems. Computer attacks may take the form of gaining access to sensitive data (to either learn its contents or to corrupt it) resident on individual systems or in the form of a so-called virus or worm to damage or destroy processors or resources in a largely indiscriminate manner. [0009] Yet another form of attack which is of increasing concern is the "denial of service" (DOS) attack in which normal network functions are demanded at rates approaching or exceeding system capacity to respond, thereby denying service to other requestors or otherwise disrupting other communications or services such as overloading telephone or power distribution networks. It has also been reported by numerous studies that many such attacks, regardless of form, are initiated by persons having some level of legitimate authorized access to the system attacked or at least a connected system. [0010] Networks are inherently susceptible to attack by exploitation of security weaknesses in network protocols and infrastructure components. In addition to unauthorized viewing and modification of data, alluded to above, security controls of the operating systems and applications installed on the network may be circumvented, network firewalls (used extensively at network boundaries) may be penetrated, network functions may be disrupted, sessions of authorized users (after they have been authenticated) can be stolen and routing functions of the network can be disrupted to misdirect network data. A concerted attack on military network infrastructure can compromise military operations or force network shutdown. Identification and authentication (I&A) capabilities provided by recently developed forms of identification certificates does not provide technical mechanisms to respond to attacks against network protocols. [0011] Traditionally, a three layered approach has been taken in an attempt to provide protection of networks. The first layer is the extensive use of firewalls to control access to the network from outside the network. However, firewalls become geometrically more difficult to manage as the number and variety of authorized accesses increases. This difficulty is particularly evident in military networks which become particularly susceptible to penetration through exploitation of errors in configuration of their access control rule set. [0012] However, firewalls are not fully effective since the manner in which TCP/IP manages packet fragmentation can be exploited for "punching through" the packet filtering system of firewalls. "Session Hijacking", although complex, can be automated to negate effective use of strong user authentication. Further, it is difficult to force all network access to be made only through the firewall. The availability of commercial modems that interface to digital PBX systems and the Remote Access Server included in Microsoft Windows(.TM.) software makes control of the use of dial-up connections to the network through firewalls impractical. [0013] The second layer of protection is strong user authentication such as biometric systems and digital certificates. However, such systems are costly and generally implemented on only the most sensitive systems and can, nevertheless, be rendered ineffective by session hijacking attacks, alluded to above, because of the inability of TCP/IP to authenticate the source address packets, to close out "half-open" connections and to protect the session sequence numbers contained in the TCP header. [0014] The third layer of protection is to maintain separate networks for each level of security classification or class of access authorization and to depend on personnel clearances. This approach is extremely costly, limits the functionality of each separate system, presents problems of maintaining data integrity and provides no protection from misuse or damage by persons having access to any given system. Further, it is generally desirable to be able to accommodate both mandatory access control (MAC) in which access is controlled based on classification of the information or resource and discretionary access control (DAC) which is based on a correlation of anticipated user function and the nature of data that may be needed to perform that function. It can be readily appreciated that MAC and DAC may each be complex and overlap with much increased complexity, greatly multiplying the number of separate systems which may be required among which data integrity must be maintained. [0015] Detection of an attack before substantial damage is done is often difficult, particularly when the attack is of the denial of service type. Viruses, for example, cannot be detected before at least some of their basic characteristics (e.g. a filename by which they are executed) is known; by which time the virus may have been widely proliferated, causing some degree of damage to each computer it has reached. A denial of service attack is, by its nature, indistinguishable from other intended functions of the system except for the volume of transactions it presents and possible similarities of requested services necessitated by the volume of requests required for a successful attack. [0016] In general, when an attack is detected, at least a major portion of network services must be disrupted in order to respond to the attack. Therefore, achieving a degree of certainty that an attack is in progress commensurate with the magnitude of necessary system disruption often unacceptably delays action and thus does not acceptably limit damage or prevent access to critical data or resources. [0017] In summary, enhancement of security in digital networks is extremely challenging in view of the weaknesses in protocols which cannot readily be changed. Most approaches proposed to date are extremely costly and compromise system functionality and utility while being difficult to implement in complex environments that cannot readily be modified. Proposals for security enhancements to date have also not been easily scalable, potentially functional across multiple networks or globally, adequately sensitive to potential attacks, capable of accurately and quickly isolating a fault or an attack and allowing error recovery or able to actively protect against attacks by authorized users, the currently most frequent source of system attacks. SUMMARY OF THE INVENTION [0018] It is therefore an object of the present invention to provide fault and potential attack encapsulation in a fine-grained manner in a digital communications network. [0019] It is another object of the invention to provide error and damage limitation and recovery in a rapid and automatic manner in a digital communications network to rapidly restore the full functionality thereof quickly and with minimal disruption. [0020] It is a further object of the invention to provide a global active response to faults and potential attacks in substantially real time while maintaining substantially undiminished network capabilities. [0021] In order to accomplish these and other objects of the invention, a method of operating a digital network having nodes which have a locally hierarchical relationship is provided comprising steps of detecting a condition at a node and communicating the condition to a trusted node locally higher in the hierarchical relationship, collecting information regarding the condition through nodes at the same or higher hierarchical level as said trusted node, and controlling a response at the node in response to the information. Continue reading about Real time active network compartmentalization... Full patent description for Real time active network compartmentalization Brief Patent Description - Full Patent Description - Patent Application Claims Click on the above for other options relating to this Real time active network compartmentalization patent application. ###  How KEYWORD MONITOR works... a FREE service from FreshPatents1. Sign up (takes 30 seconds). 2. Fill in the keywords to be monitored. 3. Each week you receive an email with patent applications related to your keywords. Start now! - Receive info on patent apps like Real time active network compartmentalization or other areas of interest. ### Previous Patent Application: Data processing system Next Patent Application: System and method of dynamically weighted analysis for intrusion decison-making Industry Class: ### FreshPatents.com Support Thank you for viewing the Real time active network compartmentalization patent info. IP-related news and info Results in 0.1718 seconds Other interesting Feshpatents.com categories: Medical: Surgery , Surgery(2) , Surgery(3) , Drug , Drug(2) , Prosthesis , Dentistry 174 |
 * Protect your Inventions * US Patent Office filing 
PATENT INFO |
|
