System And Method For Intrusion Prevention In A Communications Network

Abstract

A method and system for monitoring UDP communications and for preventing unauthorized UDP communications within a computer network. A method for managing access to a resource comprises assigning a unique user identifier to each authorized user, upon initiation of a UDP communication initialed by a specific authorized user for access to a specific resource, appending the unique user identifier of the specific authorized user to each UDP packet of the UDP communication, intercepting the plurality of UDP packets within the computer network, extracting the unique user identifier from each UDP packet to identify the specific authorized user associated with the respective UDP packet, and allowing each respective UDP packet to reach the specific resource as a function of the unique user identifier extracted from the respective UDP packet.

Description

CROSS-REFERENCE TO RELATED APPLICATION[0001]This application is a continuation and claims benefit under 35 U.S.C. § 120 of U.S. patent application Ser. No. 10 / 065,775, filed Nov. 18, 2002, now U.S. Pat. No. 7,386,889, entitled “System and Method for Intrusion Prevention in a Communications Network,” by A. David Shay, the disclosure of which is hereby incorporated herein in its entirety by reference.BACKGROUND OF THE INVENTION[0002]This invention relates generally to network security. More specifically, the invention relates to a system and method for providing trusted communications and preventing intrusions in computer communications networks from occurring.[0003]In the current state of the art, the common approach to communications network security is an attempt to identify occurrences of attacker activity after the attacker is present. This requires infrastructure inspections of every packet flow and a state-full inspection at the packet level. After performing all of this work m...

AI Technical Summary

Benefits of technology

[0007]The present invention provides an access control and user session layer security framework. It prevents unwanted connections to new and existing computing resources. It prevents unknown devices and / or users from establishing communication connections to the infrastructure. It prevents unknown devices and / or users from establishing sessions to shared application resources. It prevents known users from gaining access to application resources that are not required in the execution of their area of responsibility.

[0008]Unlike traditional intrusion detection systems, the present invention prevents intrusions rather than simply alerting a network administrator that an intrusion is occurring. The technique used by this invention is the first security approach that links business process to enabled technology utilization; thereby preventing anomalies in access and session establishment. It utilizes authentication through real-time protocol manipulation.

[0009]The invention requires granted authentication at the hardware and user session levels; thus linking hardware access to user requested services. By securing granted permissions at these levels, strange or unknown hardware devices are prevented from communicating with the network infrastructure; thus preventing threats associated with “walk-in” intrusions. Additionally, application resources are secured by controlling where user sessions are allowed; thus preventing “insiders” from gaining access to non-permitted resources and data.

[0010]The invention prevents the initiation of communication establishment through extended manipulation of the communication protocol. This approach places the decision point to the forefront of connection establishment rather than current methods of detecting unwanted “active” utilization or flow. It also eliminates the requirement for “state-full” inspection of every packet associated with end-to-end flows of utilization; thus lowering the performance burden normally associated with intrusion detection.

Problems solved by technology

It prevents known users from gaining access to application resources that are not required in the execution of their area of responsibility.

Images