JPWO2019142115A5

JPWO2019142115A5 -

Info

Publication number: JPWO2019142115A5
Application number: JP2020560628A
Authority: JP
Publication date: 2022-01-24
Anticipated expiration: 2039-01-16

Claims

A network security device for mediating communication between client computing devices and networks.
Memory that stores packet header validation rules that define parameters for packet header structure and content,
A communication interface for connecting to the client computing device and the network,
A processor interconnected with the memory and the communication interface.
Extracting an incoming header from an incoming packet in response to receiving an incoming packet from the network for transmission to the client computing device.
Performing verification of the structure and content of the incoming header in accordance with the packet header verification rules .
Acquiring the current routing route from the incoming header of the incoming packet,
Acquiring the stored routing route from the memory and
Determining whether the stored routing route and the current routing route contain a number of similar points defined in the packet header validation rule.
Determining whether one or more locations on the current routing route match a location on the restricted location list defined in the packet header validation rule.
Both (1) when it is determined that the stored routing route and the current routing route contain a threshold number of similar points, and (2) the location of the current routing route are said limited. Determining that the validation of the incoming header was successful when it does not match the location on the location list.
To perform verification by
A network security device comprising a processor configured to send the incoming packet to the client computing device in response to a successful validation of the incoming header.

The network security device of claim 1 , wherein the processor is further configured to store the current routing path in the memory in response to a successful validation of the incoming header.

The processor
Acquiring session information from the memory and
Obtaining a response sequence from the incoming header of the incoming packet and
The network of claim 1, wherein when the response sequence corresponds to the session information, the validation of the incoming header is configured to perform the validation by determining that the validation of the incoming header is successful. -Security device.

The processor
Identifying the communication protocol used in the structure of the incoming header
The validation of the incoming header by determining that the validation of the incoming header was successful when the identified communication protocol matches the baseline communication protocol defined in the packet header validation rule. The network security device according to claim 1, which is configured to perform the above.

In response to a request from the client computing device to connect to the network, the processor
To get network information and
Performing preliminary verification against the network information based on the preliminary verification rule stored in the memory,
The network security device according to claim 1, wherein the communication interface is controlled to connect to the network in response to the success of the preliminary verification.

The processor
Identifying the communication protocol used in the network and
The network security device of claim 5 , configured to perform the preliminary verification by verifying the identified communication protocol in accordance with the preliminary verification rule.

The processor
Acquiring a network routing route and storing the network routing route in the memory,
The network security device of claim 5 , configured to perform the preliminary verification by verifying the network routing route according to the preliminary verification rule.

The processor
Extracting the outgoing header from the outgoing packet in response to receiving the outgoing packet from the client computing device for transmission to the network.
Performing verification of the structure and content of the outgoing header according to the packet header verification rule,
The network security device of claim 1, further configured to transmit the outgoing packet to the network in response to a successful verification of the outgoing header.

The processor
Acquiring the current routing route from the outgoing header of the outgoing packet,
Determining whether one or more locations on the current routing route match a location on the restricted location list defined in the packet header validation rule.
The validation of the outgoing header is performed by determining that the validation of the outgoing header was successful when none of the locations of the current routing route match the location on the restricted location list. The network security device of claim 8 , which is configured to perform.

The processor
Acquiring the stored network traffic amount data from the memory,
To detect the current network traffic volume and
Determining whether the stored network traffic volume data and the current network traffic volume are within the threshold similarity.
The network security device of claim 1, further configured to perform network usage verification by determining that the verification was successful when the decision is affirmative.

The network security device of claim 10 , further comprising storing the current network traffic volume in the memory.

The current network traffic volume is traffic from individual ports, traffic to or from specified hosts, traffic to or from specified networks, and specified geography. 10. The network security device of claim 10 , comprising one or more of traffic to or from a designated geographic area.

Whether the processor has the stored network traffic volume data and the current network traffic volume within the threshold similarity based on one or more of the percentage difference and the standard deviation difference. The network security device according to claim 10 , which determines whether or not.

The network security device of claim 1, wherein the communication interface is further configured to utilize an encrypted communication protocol.

The processor
Retrieving a pre-stored address of a trusted domain name server from said memory in response to a Domain Name System (DNS) request.
14. Claim 14 , further configured to control the communication interface to forward the DNS request to the trusted domain name server via the encrypted communication protocol. Network security device.

14. The network security device of claim 14 , wherein the processor is further configured to communicate with a centralized command center over the communication interface using the encrypted communication protocol.

16. The network security device of claim 16 , wherein the processor is further configured to control the communication interface to disconnect from the network in response to receiving a disconnect command from the centralized command center. ..

16. The network security device of claim 16 , wherein the processor is further configured to reset the device to factory settings in response to receiving a reset command from the centralized command center.

The network security device of claim 1, wherein the memory further stores a dashboard application that can be executed by the client computing device.

19. The network security device of claim 19 , wherein the processor is configured to give instructions in the client computing device via the dashboard application in response to a successful validation.

The network security device of claim 1, wherein the processor is configured to control the communication interface to disconnect from the network in response to a successful verification.

A method of mediating communication between a client computing device and a network.
The process of storing packet header validation rules that define parameters for packet header structure and content, and
The process of connecting to the client computing device and the network, and
In response to receiving an incoming packet from the network for transmission to the client computing device, an incoming header is extracted from the incoming packet and the structure and content of the incoming header is verified according to the packet header verification rule. Is the process of executing
Acquiring the current routing route from the incoming header of the incoming packet,
To get the stored routing route from the memory,
Determining whether the stored routing route and the current routing route contain a number of similar points defined in the packet header validation rule.
Determining whether one or more locations on the current routing route match a location on the restricted location list defined in the packet header validation rule.
Both (1) when it is determined that the stored routing route and the current routing route contain a threshold number of similar points, and (2) the location of the current routing route are said limited. Determining that the validation of the incoming header was successful when it does not match the location on the location list.
And the process of performing verification by
A step of transmitting the incoming packet to the client computing device in response to the successful verification of the incoming header.
How to have.

Identify the communication protocol used in the structure of the incoming header and
Determining that the validation of the incoming header was successful when the identified communication protocol matches the baseline communication protocol defined in the packet header validation rule.
22. The method of claim 22, wherein the verification of the incoming header is performed.

In response to a request from the client computing device to connect to the network, the method:
The process of acquiring network information and
The process of performing preliminary verification against the network information based on the stored preliminary verification rules, and
The process of connecting to the network in response to the success of the preliminary verification
22. The method of claim 22.

Identify the communication protocol used in the network and
Verifying the identified communication protocol according to the preliminary verification rules.
24. The method of claim 24, wherein the preliminary verification is performed.

Acquires a network routing route, stores the network routing route, and
Verifying the network routing route according to the preliminary verification rule.
24. The method of claim 24, wherein the preliminary verification is performed.

A step of extracting an outgoing header from the outgoing packet in response to receiving an outgoing packet from the client computing device for transmission to the network.
The process of performing verification of the structure and contents of the outgoing header according to the packet header verification rule, and
The step of transmitting the outgoing packet to the network in response to the successful verification of the outgoing header.
22. The method of claim 22.

The current routing route is acquired from the outgoing header of the outgoing packet, and the current routing route is acquired.
Determining if one or more locations on the current routing route match a location on the restricted location list defined in the packet header validation rule.
Determining that the validation of the outgoing header was successful when none of the locations on the current routing route match the location on the restricted location list.
27. The method of claim 27, which performs the verification of the outgoing header.

Get the stored network traffic volume data
Detects the current network traffic volume and
Determine if the stored network traffic volume data and the current network traffic volume are within the threshold similarity.
To determine that the verification was successful when the decision is positive.
22. The method of claim 22 for performing network usage verification by.

29. The method of claim 29, comprising storing the current network traffic volume.

The current network traffic volume is traffic from individual ports, traffic to or from specified hosts, traffic to or from specified networks, and specified geography. 29. The method of claim 29, which has one or more of the traffic to or from a designated geographic area.

Based on one or more of the percentage differences and the standard deviation differences, it is determined whether the stored network traffic volume data and the current network traffic volume are within the threshold similarity. 29. The method of claim 29, comprising a process.

22. The method of claim 22, comprising the step of utilizing an encrypted communication protocol.

The process of retrieving a pre-stored address of a trusted domain name server in response to a Domain Name System (DNS) request, and
With the step of forwarding the DNS request to the trusted domain name server via the encrypted communication protocol.
33. The method of claim 33.

34. The method of claim 34, comprising communicating with a centralized command center using the encrypted communication protocol.

35. The method of claim 35, comprising disconnecting from the network in response to receiving a disconnect command from the centralized command center.

35. The method of claim 35, comprising resetting to factory settings in response to receiving a reset command from the centralized command center.

22. The method of claim 22, comprising storing a dashboard application that can be run by the client computing device.

38. The method of claim 38, comprising the step of giving instructions in the client computing device via the dashboard application in response to unsuccessful verification.

22. The method of claim 22, comprising disconnecting from the network in response to unsuccessful verification.