TWI254533B - A method of data communication control applying package-oriented filtering mechanism - Google Patents

Abstract

This invention is a method of data communication control applying package-oriented filtering mechanism, by establishing a gateway control mechanism toward the data package transmission protocol on a server to control data communication. And by enforcing the method presented in the invention, controls employees' data communication on the web to prevent betraying confidential information via web communication from using such as web browsers or data transmission programs.

Description

1254533 ------ V. Description of the invention (1) The method of the invention belongs to the method of preventing +1 & moxibustion ~... &&; 刺 竹 竹 汛 汛 内部 内部 内部 内部Fang Xuan Xuan Xuan method. The invention is a method for preventing the leakage of the present invention. The present invention is a method for controlling the data communication. In order to prevent the internal employees from carrying out information through the network communication method, uploading and downloading the bait material to prevent the cleansing of the product from the general bandit L previous technology] network service is easy to see, due to problems. The communication process is improved, and the cost is from the performance of the computer and the frequency of the invasion. The internal staff can be based on the international out, only 15% to the inside of the enterprise. According to numerous attack lines, information leakage incidents, such as hackers and other attack-based storage devices, are not easy to control afterwards. The problem is that the most important application is that the company is more simplistic and less effective. It is also the ability to get different but to prevent the injury. Computer security association I external invasion, the international authority and the attacker's attacker. Enterprise or network transmission is not easy to detect and ignore. Safety Internal staff saves costs and increases productivity is the most important thing to worry about how to communicate with each other's systems. Productivity Once the network system is more convenient, stronger, and better used than before, it increases the intrusion of illegal enterprises, but ignores the company's harm. The ICSA Security Report refers to the fact that there are 60 to 80% of the leaks from the statistics provided by CS I / FB I. The 'most important and most security incidents are from inside the company, not from The inside of the company has malicious employees who can easily take away the information through external means, and in advance, for the enterprise, the internal information security incident caused the greatest economic loss, and the intentional or unintentional information leakage caused by the incident.

1254533 V. Description of invention (2) Economic loss. On the other hand, all programs or software used on personal computers use the network system', so all access data is from the server on the local area network (LAN). The average person's online activities include sending and receiving emails (such as using 〇11_1:1〇〇1^ Express • ·. Mail server), browsing the web (such as using Internet Expl〇rer • · · web browser), uploading and downloading files (such as Use CuteFTp···Data Transfer Application Private). Among them, the webpage is the most widely used. Through the browser, in addition to "browsing webpage i, etc. 1 μ "8^, vu ττ see Μ" can also be used as "sending and receiving mail" (for example, logging in to Yahoo, Hotmail) Waiting for someone to pick up the e-mail from the i-search portal, and upload and download the file. In addition, the most v, u are popular, such as MSN Messenger, Yah〇Q Messenger and other application-aged Messenger slots, video conversations and so on. ~ Can chat, send newsletters, pass these web applications, and also constitute corporate information a = can, although it gives companies a large degree to browse the non-working network of the major crisis. The important documents that can be sent by the employees of the company can be easily transferred to the company, the sauce [' can chat, and the company can be outside the company. In addition, because the software has a company that requires each department to protect and copyright issues, not the business owner will bend the demand for the same = the software is the same, in order to avoid infringement, install the unauthorized software, poison, but have At the time, employees will be so convenient and private as to "if the image of each department is the image and reputation of the company." The staff of the Ministry of Development and the Ministry of Technology, in other words, the marketing department, the business department, the research department, the accounting department, the warehousing department, and the administrative department are expected to be in the normal work behavior _ beigong, if the information is transmitted online,

IHK 1254533 V. INSTRUCTIONS (3) Not a normal work behavior. Therefore, in order to allow employees to conduct productive behavior during the working hours of the bee, it is also possible to set the function of the use authority for the department and the nature of the work, and in order to avoid the above situation and how to overcome such problems, it has one Practical thinking direction. SUMMARY OF THE INVENTION In view of this, the present invention provides a method for controlling data communication by using a packet-oriented filtering mechanism. The main purpose of the present invention is to solve the problem in the prior art that the internal employees can easily upload and download data through network communication. The measures taken to prevent the bubble are caused by problems such as excessive load on the server end and high management costs. The second object of the present invention is to solve the problem of preventing the convenience of employees in the enterprise from using the network or using other programs/software to perform network communication irrelevant to their own work duties. The network data communication control mechanism proposed by the present invention is directed to a communication connection (por t) and a specific domain name (Universal Resource) of a local network (L 〇ca 1 area Netw 〇rk; LAN) to an external network. Locator, URL) or the corresponding IP address is regulated. When a company employee is at work, the use of controlled network communication behavior is recorded and prohibited from being used, so that the enterprise manager can query and manage it. A third object of the present invention is to provide a data packet transmission rule according to a data packet transmission protocol, and to transmit a data packet or a secure data transmission layer (Secure Socket Layer, SSL) for a hypertext ti'ansmission protocol (http). Network security protocol

1254533 -------- V. Description of invention (4) Capacity for sending data packets and large network communication and communication enterprise management The present invention is flexible for each material communication and the use of the domain, and further information Communication, state. According to this 1. in a rule; 2. set 3. will be a 4 · the servo link communication; 5. the server related to the invention is small, while the data block reader query and more to present a user, even For each, the establishment can be accurate and easier to manage, and the behavior of the employee package is managed. The right to use is the method used by the externally-visited user to make the information of each departmental enterprise member sealed in the workable rules, and the method disclosed by the invention is used by the special department. At least the server end does not have a communication connection and a data packet transmission rule; the data communication control rule is stored in the manner or transmission of the packet transmission, and any recorded recording is performed in a further concept, that is, the time period can be used. Network resources, grouping, and affiliates, to increase the management of the staff can use the network data communication, the following steps: The rules and a URL browser server accept at least the server-side database; The user's login is used to control the details and technology of the network through the gateway device. The drawing is as follows: [Embodiment] The present invention is a method for controlling the data communication method by using a packet-oriented filtering mechanism, and the basic system of the present invention is stated before the method of the present invention.

Page 9 1254533 V. Description of the invention (5) System architecture, please refer to FIG. 1 , which is a system architecture diagram of a method for controlling data communication using a packet-oriented filtering mechanism according to the present invention, which is explained as follows: The server terminal 100 is configured to be connected to one of the server terminals 100 and the at least one user terminal 20, and the server terminal 100 and the server terminal 100 are transmitted through the internal network of the enterprise. (Local A rea N e ΐ w 〇rk ; LAN ) is connected, and through the setting of the local area network to define the gateway device (Gat eway) controlled by the server terminal 1 0 0 Linking to the external network and performing data transmission, the server terminal 1 0 0 establishes a control rule for each user terminal 2 and deposits the servo T-end database 1 1 0 ' to control the user The terminal 200 uses the information processing device that can be connected to the network to communicate with the network via the gateway (Gateway), and limits the websites that can be browsed by individual employees and the brains of uploading and downloading files. To the network information processing device, Ij the palm type electric type, shame (N B), a personal digital assistant (PD A), a combination mobile phone and hearing = opposed to any optional -. The material transmission wheel carries out the communication between the user terminal and the gateway through the gateway device, such as through the inquiry, to prevent the soil and shell workers from using the confidential information to leak. 11 or use the data transfer application to lightly manage the use of the above-mentioned system of the company, and then you can use the information processing control mechanism in the enterprise to control the data. Please refer to Figure 2 for the use of the package guide. Please refer to Figure 2 for a more detailed description of the method for the communication of the material. The invention uses the packet-oriented filtering mechanism.

The following is a step-by-step flow chart, the description of which is detailed as follows: 1254533 V. Description of the invention (6) First, a data communication control rule is established, the steps of which include setting a communication connection rule on a server end 1 0 0 And a URL browsing rule (step 300); and then, according to the data packet transmission protocol, a data packet transmission rule is set (step 310), that is, the data packet is configured to be transmitted by a hypertext transmission protocol (http). The control method (step 32 0 ) and the control method for transmitting the data packet by the secure data transmission layer (the network security protocol of (3) "Socket Layer, SSL" (step 33 0 ); the control set in the above step 32 0 The manner may be arbitrarily selected by the method of prohibiting the URL link (step 32U, allowing only the data download (step 322), allowing the data to be downloaded, and limiting the amount of uploaded data to be less than a specific capacity (step 323), allowing any data transmission (step 3 24). The control mode set by the above step 33 0 can be linked by the forbidden URL (step 331), and only the data download is allowed (step 332). It is only allowed to transfer less than a specific capacity of the login data (step 33 3 ), any mode of allowing any data input (step 334), and the size of the specific capacity described in steps 323 and 333 is Set by the feeding device end; after the establishment of the tributary communication control rule I, the data communication control rule is stored in the server end database 11〇 (step 34〇); after the absence, the use is to be used When the terminal 20 wants to use the information processing device connectable to the network to enter the network communication, the server terminal must accept at least one of the used logins for network communication (step 35); The network communication via the gateway is controlled by the server 100 (step 3 6 〇). The communication connection rule described in the above step 300 is for

Page 11 1254533

Any application that transmits a data packet through a communication port (P0RT) is limited by the server terminal 100 to the communication link of the data packet, and the URL browsing rule is determined by the server terminal 丨0 0 A specific domain name (Universal Resource Locator, URL) or a corresponding 1? address is set to a restriction mode, and the restriction mode can be determined by the server terminal. However, by using a packet-oriented filtering mechanism of the present invention The implementation of the method of controlling data communication can control the behavior of employees in the organization to conduct network transmissions to prevent employees from using network communication, such as using a browser or using a data transfer application to bubble corporate confidential information. Therefore, a packet-oriented filtering mechanism for intra-network communication is proposed. The following is a specific embodiment and a detailed description of the implementation manner. Please refer to the 3A, 3B, and 3C diagrams for establishing intra-enterprise network communication. The flow chart of the packet-oriented filtering mechanism step. First, please refer to FIG. 3A, and establish a usage permission rule for each user terminal 2000 through a server terminal 1 and store it in the server end database 11 0 (step 4 0 0 ); Then, when the user terminal 2 uses the information processing device to perform network communication, it is necessary to log in to the server port, and the server server 100 accepts at least one user terminal. Log in (step 4 1 0) to confirm the identity of the user terminal 2 and its applicable usage rights rules; then, the user terminal 200 transmits the gate controlled by the server terminal 1 The router performs network communication (step 4 2 0); the server terminal 1 defines the user terminal 2 according to the usage permission rule applicable to the user terminal 2000.

Page 12 1254533__________ V. Invention Description (8) Road connection authority and control the transmission of data packets (step 4 3 〇); Finally, record the user terminal 2000 data transmission status (step 4 4 〇) for query . The detailed process step of establishing the usage permission rule is step A. Please refer to FIG. 3B, which is a flow chart of steps of establishing a usage permission rule for each user end through a server end. The detailed description is as follows: The usage permission rule established in the above step 40 0 includes establishing one sharing rule of the user terminal 200 (step 4 〇丨) and setting the execution period and priority order of the sharing rule (step 4) 〇11), establishing a group rule of the user terminal 200 (step 4 〇 2 ) and setting an execution period and a priority order of the group rule (step 4021), establishing one of the user terminals 2 Temporary rules (step 4 0 3 ) and setting the execution period and priority order of the temporary rules (step 4 0 3 1 ), and establishing a data communication control rule (step B); waiting for the user terminal 2 0 0 Establishing the sharing rule, the group rule, the temporary rule, and setting the execution period and priority order of each rule, and completing the establishment of the data overnight control rule, the rules of the rule server will be established In the use permission rule (step 40 8 ) · 'Next, proceed to step 41 〇, 1 followed, the sharing rule is for all the user-side 2 control rules can be established to include at least one working time rule, - It is implemented in the form of off-duty time rules and one visitor rule. The group rules are the rules applicable to the users of the company, the department, the group, and the users of the domain to log in to the uniform = 1 〇 。. The provisional rule is for a control rule that is required to be specific to the user terminal within a certain period of time, and

Page 13 1254533 V. Description of the invention (9) The rules and the length of the specific time can be set by the server terminal 2 〇 。. The detailed process steps for establishing a data communication control rule are step β. Please refer to FIG. 3C for the flow chart of the steps of establishing a data communication control rule for each user end through a server end. Further details are as follows:

First, a communication link rule and a URL browsing rule are set (step 4 04); then, according to the data packet transmission protocol, a data packet transmission rule (step 4 0 5) is set, that is, the setting is set to a hypertext transfer protocol ( Hypertext transmission protocol, http) a method for controlling the transmission of data packets (step 406) and a method for controlling the transmission of data packets by a secure data transfer layer (Secure Socket Layer (SSL) network security protocol (step 40 7); The control method set in the above step 40 6 can be linked by the prohibition URL (step 40 6 1 ), only the data download is allowed (step 4 0 62 ), the data download is allowed, and the limit upload data amount is less than a specific capacity (step 4 0 6 3 ), allow any data transmission (step 4 〇 6 4) to choose any one of them: and the control method set in step 4 0 7 above can be linked by the prohibition URL (step 4 0 7 1 ), only data download is allowed (step 4072), it is only allowed to transfer less than a specific capacity of the login data (step 4 〇 7 3 ), any mode of allowing any data transmission (step 4074), The size of the specific capacity described in step 4063 and step 4 0 73 is set by the server end 1; after the step B establishes the data communication control rule, the process proceeds to step 4 0. 8 and continue the unfinished process. Although the present invention has been disclosed in the foregoing preferred embodiments, it is not intended to limit the invention, and those skilled in the art, without departing from the invention.

Page 14 1254533

Page 15 1254533 Brief description of the diagram [Simple description of the diagram] The first diagram is the system architecture diagram of the method for controlling data communication using the packet-oriented filtering mechanism of the present invention. The second diagram is the control data of the invention using the packet-oriented filtering mechanism. The flowchart of the steps of establishing the communication method; and the 3A, 3B, and 3C diagrams are flow charts for the steps of establishing a packet-oriented filtering mechanism for network communication in the enterprise. [Illustration of the symbol]

100 server end 110 server side database 1 50 network backbone 2 0 0 user side step 3 0 0 set a communication port on a server side 槔 rules and a web browsing rule step 3 1 0 set a data packet transmission Rule Step 3 2 0 Controlling the transmission of data packets in the Hyper-File Transfer Protocol Step 3 2 1 Prohibit URL Links

Step 3 2 2 Only data download is allowed. Step 32 3 Allow data download and limit the amount of uploaded data to be less than a specific capacity. Step 32 4 Allow any data transfer Step 3 3 0 Transfer data at the secure data transfer layer.

Page 16 1254533 Brief description of the steps Step 3 3 1 Prohibit URL link Step 3 3 2 Only allow data download Step 3 3 3 Only allow login data smaller than a specific capacity Step 3 3 4 Allow any data to pass 'J Step 3 4 0 Store the data communication control rules in the feed server database. Step 3 5 0 The server receives at least one user-side login for network communication. Step 3 6 0 The server-side control passes through the gateway. The network communication step of the device is performed by using a server to establish a usage permission rule for each user terminal and depositing it into the server side database. Step 40 1 Establish a sharing rule of the user terminal. Step 4 0 1 1 Set the execution period and priority of the sharing rule. Step 4 0 2 Establish a group of the user terminal. Rule Step 40 2 1 Set the execution period and priority order of the group rule. Step 403 Establish a temporary rule for the user terminal. Step 4 0 3 1 Set the execution period and priority order of the temporary rule. Step 4 0 4 Set one Communication link rules and a URL browsing rule Step 4 0 5 Set a data packet transmission m Rule Step 4 0 6 Control method for transmitting data packets by hyper-file transfer protocol Step 40 6 1 Prohibit URL link step 40 6 2 Only data download is allowed Step 40 6 3 Allow data download and limit the amount of uploaded data to less than a specific capacity

Page 17 1254533 Schematic description of the steps Step 40 64 Step 407 Step 4 0 7 1 Step 40 72 Step 4 0 7 3 Step 4 0 7 4 Step 408 Step 4 1 0 Step 420 Step 430

Step 4 4 0 Step A Step B Allow any security-enforced data packet to be banned. Only the data is allowed to be transmitted. Only the server is allowed to allow the server to access the server. The device-side permission rule is limited to the control data seal record. The use establishes a use to establish a data.

The network security protocol transmission data mode of the material transmission and transmission layer downloads the login data material that is smaller than a specific capacity, and the respective rules that are established are merged into the use. At least one login of the user terminal is controlled by the server end. The gateway device is configured according to the usage of the user terminal, and the network connection authority of the user end is set and the transmitter data transmission status permission rule is adopted.

Claims (1)

1254533 VI. Application for Patent Scope 1. A method for controlling data communication by using a packet-oriented filtering mechanism is to control the data communication by means of a server-side transmission protocol for data packets. The method comprises the following steps: setting a communication connection rule and a website browsing rule on a server end; setting a data packet transmission rule; storing a data communication control rule in the server end database; the servo The terminal end accepts at least one user-side login for network communication; and the server side controls network communication via the gateway. 2. A method for controlling data communication using a packet-oriented filtering mechanism as described in claim 1, wherein the server end accepts at least one user-side through a local area network (Local Area Networ*k 'LAN) The connection is terminated, and the user terminal must be connected to the external network via the gateway controlled by the server to perform data transmission. ^ 3 · A method for controlling data communication using a packet-oriented filtering mechanism as described in claim 1 of the patent scope, wherein the user terminal utilizes an information processing device connectable to a network backbone, from a desktop computer Any combination of a pen-type computer (ΝΒ), a personal digital assistant (PDA), a mobile phone, and a palm-sized information processing device. 4. The method of applying the packet-oriented filtering mechanism to the official data communication as described in the first application of the patent scope, wherein the communication connection (P) rule Page 19 1254533 VI. Scope of Application ‘After any application that transmits a data packet through a communication port, the server end limits its communication port for transmitting data packets. 5) The method for controlling data communication by using a packet-oriented filtering mechanism as described in claim 1, wherein the URL browsing rule is performed by the server for a specific domain name (Universal Resource Locator, URL) or a corresponding IP address. The address is set to a restriction mode, and the restriction mode can be defined by the server side. 6 · The method for controlling data communication using the packet-oriented filtering mechanism as described in claim 1 of the patent scope, wherein the data communication control rule includes the communication link (P 0RT ) rule, the website browsing rule and the data packet Transmission rules. 7) A method for controlling data communication using a packet-oriented filtering mechanism as described in claim 1, wherein the step of setting a data packet transmission rule comprises at least the following method: setting a hypertext transmission protocol 'http) The method of controlling the transmission of data packets and setting the control method for transmitting data packets by the Secure Socket Layer (SSL) network security protocol. 8 · The method for controlling the transmission of data packets as described in item 7 of the patent application, wherein the setting is to control the transmission of data packets by the Hypertext Transfer Protocol (http), which may be arbitrarily selected by at least one of the following methods: Only data downloads, data downloads, and restricted uploads are allowed to be less than a specific capacity, allowing any data transfer. Page 20 1254533 VI. Scope of Patent Application 9 · The method of controlling packet communication using the packet-oriented filtering mechanism as described in item 8 of the patent application scope, wherein the size of the specific capacity is set by the server itself. I. A method for controlling data communication using a packet-oriented filtering mechanism as described in claim 7 of the patent application, wherein the setting is controlled by a secure data transfer layer (SSL) network security protocol for transmitting data packets, which may be at least You can choose any of the following methods: prohibit URL connection, allow data download only, allow only less than one specific capacity of login data, and allow any data transmission. II. The method of using the packet-oriented filter mechanism to control data communication as described in the first paragraph of the patent application, wherein the specific capacity size and the limitation of the login data type are defined by the server side. 1 2. A packet-oriented filtering mechanism for intra-enterprise network communication, which establishes a usage permission rule for each user end through a server end, and sets a control mode for the gateway device (Gateway) to control at least A method for transmitting data by the user terminal, comprising at least the following steps: establishing a usage permission rule for each user end through a server end and storing the usage permission database; the server end accepts at least one The user terminal logs in; the user terminal performs network communication through the gateway controlled by the server; and the server end defines the user terminal according to the usage permission rule applicable to the user terminal. Network access permissions and control of the transmission of data packets. Page 21 1254533_6. Patent Application Range 1 3. The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 12, wherein the server end accepts at least one of the user-end transmission areas. A network (Local Area Network, LAN) is connected, and the user terminal must be connected to the external network via the gateway controlled by the server to perform data transmission. 1 4 · The packet-oriented filtering mechanism for intra-network communication in the enterprise as described in claim 12, wherein the user terminal utilizes an information processing device connectable to a network backbone, and is available from a desktop computer Any combination of a notebook computer (NB), a personal digital assistant (PDA), a mobile phone, and a palm-sized information processing device. 1 5. The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 14 of the patent application scope, wherein the network backbone can be a telecommunication network, and refers to all telecommunication networks having communication and data transmission functions. Architecture and type. 1 6 · The packet-oriented filtering mechanism for intra-network communication in the enterprise as described in claim 12, wherein a usage permission rule is established for each user terminal through the server end and stored in the server The step of the end database, which at least includes establishing the following rules: establishing a sharing rule of the user terminal, establishing a group rule of the user end, establishing a data communication control rule of the user end: and the server The end will merge the established rules into the usage permission rules. Page 22 1254533_ VI. Application for Patent Scope 1 7. The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 16 of the patent application scope, wherein the sharing rule is for all the control rules of the user terminal, The establishment includes at least one working time rule, an off-duty time rule, and a visitor rule. 1 8 · The packet-oriented filtering mechanism for intra-network communication as described in claim 17 of the patent application, wherein the visitor rule is a regulation rule applicable to a user outside the enterprise employee when logging in to the server. 1 9 · The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 16 of the patent application scope, wherein the group rule is logged in to the server according to the department, grouping, and user of the domain to which the employee belongs. The regulatory rules applicable at the end of the device. 2 0. The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 16 of the patent application, wherein the sharing rule of the user terminal is established, and the step of setting the execution period and the priority order of the sharing rule is further included. . 2 1 · The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 16 of the patent application, wherein establishing a group rule of the user terminal, further including setting an execution period and a priority order of the group rule The steps. 2 2. The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 16 of the patent application, wherein the sharing of one of the user-side sharing rules, establishing a group rule of the user terminal, establishing the The step of the data communication control rule of the user end may further comprise the step of establishing a temporary rule of the user end. Page 23 1254533 VI. Application for Patent Scope 23. The packet-oriented filtering mechanism for intra-enterprise network communication as described in item 2 of the patent application scope, wherein one of the temporary rules of the user terminal is established, and the setting of the temporary Use the rule execution time and priority order. 24. The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 2, wherein the temporary rule is directed to a specific control rule for the user terminal within a specific time period, wherein The temporary rule and the length of the specific time can be set by the server itself. 2 5 · The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 16 of the patent application scope, wherein the server side merges the rules established by the server into the steps of using the permission rule, and the merge logic principle is It is defined by the server itself. 2 6 · The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 16 of the patent application, wherein the data communication control rule of one of the user terminals is established, and the gateway is set for the transmission protocol of the data packet (Gateway) control method for controlling the transmission of data packets via a gateway device, comprising at least the following steps: setting a communication connection rule and a website browsing rule; and setting a data packet transmission rule. 2 7 · The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 26, wherein the communication port (p〇RT) rule is for transmitting data packets for any communication link. The application is defined by the server end of the direct value private: owe, Bu & with the communication link of the Fu body packet. 2 8 ·If you apply for the patent scope 2nd fi j, the +, ^ b member of the intranet communication Page 24 1254533 VI. Patent-scoped packet-oriented filtering mechanism, wherein the URL browsing rule is set by the server for a specific domain name (Universal Resource Locator 'URL) or a corresponding ^ address, and This restriction can be defined by the server itself. 2 9 · The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 26, wherein the data packet transmission rule is set to at least include the following method: setting a hypertext transmission protocol , http) The method of controlling the transmission of data packets, and setting the control method for transmitting data packets in the Secure Security Layer (Secure Socket Layer, SSL) network security protocol. 3 0 · The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 29, wherein the setting is controlled by the Hyper-File Transfer Protocol (http) to transmit data packets, which may be arbitrarily selected by at least the following methods One: prohibiting URL linking, allowing only data downloading, allowing data downloading and limiting the amount of uploaded data to be less than a specific capacity, allowing any data transmission. 3 1 · The packet-oriented filtering mechanism for intra-network communication in the enterprise as described in claim 30, wherein the size of the specific capacity is set by the server itself. 3 2 · The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 29, wherein the setting is to transmit a negative packet by a secure communication layer (Secure Socket Layer (SSL) network security protocol) The control method can be at least one of the following ways: Page 25 1254533 VI. Scope of application for patents It is forbidden to link URLs, only allow data downloads, and only allow the transmission of less than one specific capacity of the login data, allowing any data transmission. 3 3 · The packet-oriented filtering mechanism for intra-enterprise network communication as described in claim 3, wherein the specific size and the limitation of the login data type are defined by the server. Page 26