Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L12/00—Data switching networks
  • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
  • H04L63/0272—Virtual private networks
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L12/00—Data switching networks
  • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
  • H04L12/46—Interconnection of networks
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
  • H04L69/04—Protocols for data compression, e.g. ROHC
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/40—Network security protocols

Definitions

• the present invention relates to the field of data communications. More particularly, the present invention relates to techniques for implementing secure virtual private networks over public or otherwise insecure data communications infrastructures.
• Preventing unauthorized access to data traversing an enterprise's LAN is relatively straightforward. This applies to both unauthorized accesses by members of the enterprise and, more importantly, to third parties on the outside. As long as intelligent network management is maintained, unauthorized accesses to data traversing an enterprise's internal LAN are relatively easily avoided. It is when the enterprise spans multiple sites that security threats from the outside become a major concern.
• the first option is to interconnect the offices or various sites with dedicated, or private communications connections often referred to as leased lines.
• This is the traditional method organizations use to implement a wide area network (WAN).
• WAN wide area network
• the disadvantages of implementing an enterprise owned and controlled WAN are obvious: they are expensive, cumbersome and frequently underutilized if they are established to handle the peak capacity requirements of the enterprise.
• the obvious advantage to this approach is that the lines are dedicated for use by the enterprise and are therefore secure, or reasonably secure from eavesdropping or tampering by intermediate third parties.
• An alternative to the use of dedicated communications lines in a wide area network is for an enterprise to handle intersite data distributions over the emerging public network space.
• the Internet has transitioned from being primarily a tool for scientists and academics to a mechanism for global communications with broad ranging business implications.
• the Internet provides electronic communications paths between millions of computers by interconnecting the various networks upon which those computers reside. It has become commonplace, even routine, for enterprises, even those in nontechnical fields, to provide Internet access to at least some portion of the computers within the enterprise. For many businesses this facilitates communications with customers, potential business partners as well as the distributed members of the organization.
• the Internet is a convenient tool to provide electronic communications between members of the enterprise.
• two remote sites within the enterprise may each connect to the Internet through a local Internet Service Provider (ISP).
• ISP Internet Service Provider
• This enables the various members of the enterprise to communicate with other sites on the Internet including those within their own organization.
• the limiting disadvantage of using the Internet for intra-enterprise communications is that the Internet is a public network space. The route by which data communication travel from point to point can vary on a per packet basis, and is essentially indeterminate. Further, the data protocols for transmitting information over the various networks of the Internet are widely known, and leave electronic communications susceptible to interception and eavesdropping with packets being replicated at most intermediate hops.
• the present invention is thus directed toward the protocols and architecture for implementing secure virtual private networks over the Internet or other public network apparatus.
• the architecture of the present invention introduces a site protector or virtual private network (VPN) unit which moderates data communications between members of a defined VPN group.
• the site protector resides on the WAN side of the site's router or routing apparatus which is used to connect the ente ⁇ rise site to the Internet.
• the site protector will reside on the LAN side of the router. The essential point for all embodiments is that the site protector be in the path or all relevant data traffic.
• the site protector or VPN Unit implements a combination of techniques for data packet handling when packets are to be sent between members of the group.
• the packet handling processes include various combinations of compression, encryption and authentication, the rules for each of which may vary for members of different groups.
• the various parameters defining the compression, encryption and authentication are maintained in lookup tables in the associated VPN Units.
• the lookup tables maintain information not only for fixed address members of the group but support is also provided for remote clients. This ability allows remote users to dial into a local Internet Service Provider and still maintain membership in a virtual private network group for secure communications over the Internet with other members of the group.
• the site protector may, in one embodiment, be simulated by software running on the remote client.
• the VPN Units or site protectors may be dynamically configured to add or subtract members from the virtual private network group or recognize their movement, or change other parameters affecting the group.
• Various other packet handling aspects of the invention include addressing the problem of some data packets growing too large by the inclusion of encryption and authentication information.
• Another packet handling aspect provides a mechanism for Internet communications which hides information identifying the source and destination of the data packet.
• the VPN Units are treated as the source and destination for the Internet communication data packets with the VPN Units encapsulating the source and destination addresses of the endstations.
• This embodiment is one designed to reside on the WAN side of a given site's router.
• a combination of computer hardware and software are provided for carrying out the processes of the VPN apparatus for compression, encryption and authentication under the direction of a microprocessor.
• Figure 1 illustrates a prior art configuration for an exemplary ente ⁇ rise' s intraente ⁇ rise communication architecture.
• Figure 2 illustrates an ente ⁇ rise communication scenario in accordance with the present invention utilizing the Internet or other public network space as the vehicle for conveying messages between members of a virtual private network.
• Figure 3 illustrates a flow diagram for the handling of a packet being transmitted from one member of a virtual private network group to another member over the Internet.
• Figure 4 illustrates the handling of a data packet received over the Internet by one member of a virtual private network group from another member.
• Figure 5 illustrates graphically the life cycle of a data packet being sent from one member of a virtual private network group to another over the Internet.
• Figure 6 illustrates an alternate life cycle of a data packet being sent from one member of a virtual private network group to another over the Internet where the source and destination addresses of the group members are also concealed.
• Figure 7 illustrates an architectural block diagram for an implementation of a virtual private network unit in accordance with one embodiment of the present invention.
• FIG. 8 illustrates a more detailed block diagram for one implementation of a virtual private network unit in accordance with one embodiment of the present invention.
• An apparatus and apparatus are disclosed for implementing secure virtual private networks for ente ⁇ rise communications over the Internet or other public network space.
• the present invention is described predominantly in terms of utilizing the Internet as a communications medium, the concepts and methods are broad enough to accomplish the implementation of secure virtual private networks over other public or insecure communications media.
• numerous specific details are set forth such as particular encryption or key management protocols, in order to provide a thorough understanding of the present invention. To one skilled in the art, however, it will be understood that the present invention may be practiced without such specific details. In other instances, well- known control structures and apparatus components have not been shown in detail in order not to obscure the present invention.
• components implemented by the present invention are described at an architectural, functional level. Many of the elements may be configured using well-known structures, particularly those designated as relating to various compression or encryption techniques. Additionally, for logic to be included within the apparatus of the present invention, functionality and flow diagrams are described in such a manner that those of ordinary skill in the art will be able to implement the particular methods without undue experimentation. It should also be understood that the techniques of the present invention may be implemented using a variety of technologies. For example, the virtual private network unit or site protector to be described further herein may be implemented in software running on a computer apparatus, or implemented in hardware utilizing either a combination of microprocessors or other specially designed application specific integrated circuits, programmable logic devices, or various combinations thereof.
• FIG. 1 there is shown a traditional scenario for intra- ente ⁇ rise data communications for a distributed organization.
• the enterprise consists of a headquarters location 105 with additional sites or branches 110 and 112, respectively.
• the headquarters' site 105 as well as the branch sites 110 and 112 may each comprise numerous personnel, many of whom are provided with computers or work stations with network access.
• the internal network configurations at the headquarters for branches may take many forms including one or several local area networks (LANs).
• LANs local area networks
• dedicated or leased communications lines 115 and 120 may be provided for intersite communications between headquarters and the branches.
• an optional dedicated communications path 125 may be provided between the branches 110 and 112.
• data packets between branch 110 and branch 112 may be routed through the headquarters' network equipment.
• FIG. 1 there is shown in Figure 1 that it is frequently desirable for other members of the ente ⁇ rise who may be on the road or working from home or other remote locations to exchange data with other members of the ente ⁇ rise.
• remote clients 150 and 155 communicating with the headquarters over long distance telephone lines 157 and 158. This example assumes that the remote clients are in a truly remote location from the headquarters.
• the remote clients 150 and 155 are also respectively shown having local access to the Internet through local ISPs 160 and 165.
• FIG. 1 The above description of an ente ⁇ rises data communications configuration according to Figure 1 illustrates the disadvantages described in the previous section. These disadvantages are eliminated by implementation of the present invention as illustrated generally with reference to Figure 2.
• the headquarters 105, first branch 110 and second branch 112 of the organization are illustrated in a more detailed logical way then presented in Figure 1.
• the headquarters 105 is illustrated with three endstations 201, 202 and 203, respectively coupled to communicate data packets over local area network (LAN) 205.
• LAN local area network
• the branch site 1 10 is shown having a plurality of endstations 21 1, 212 and 213 respectively coupled to communicate data locally over LAN 215.
• the second branch site 112 is shown with an illustrative set of computer stations 221, 222 and 223 connected to communicate over LAN 225.
• the customer site 140 is also illustrated in Figure 2 as comprising of plurality of computers illustrated by 331 and 332 coupled to communicate over the customer's LAN 235.
• the local area networks utilized for data communications within the headquarters, customer and branch sites may adhere to a wide variety of network protocols, the most common of which are Ethernet and Token Ring.
• each of the LANs for the particular sites illustrated in Figure 2 ultimately interconnect to the Internet 250 through an associated routing or gateway device which are identified as routers 240, 242, 244 and 246, respectively.
• IP Internet Protocol
• remote clients 150 and 155 illustrated in Figure 2 it is understood that they utilize communication software to dial up a local Internet service provider which itself provides the gateways necessary for communications over the Internet 250.
• VPNU units in the overall system architecture represents only one placement choice. It will be clear from the materials that follow that the key point with respect to VPNU placement is that they reside in the path of data traffic. In many embodiments, it may in fact prove desirable to situate the VPNU on the LAN side of a site's router.
• the VPN Units maintain lookup tables for identifying members of specific virtual private network groups. When a data packet is sent between source and destination addresses that are both members of the same VPN group, the VPN Unit will process the data packet from the sending side in such a way as to ensure that it encrypted, authenticated and optionally compressed. Likewise, the VPN Unit servicing the site where the destination address is located will detect that a packet is being propagated between members of the same VPN group.
• the receiving VPN Unit will handle the process of decrypting and authenticating the packet before forwarding it toward the destination endstation. In this way, secure data communications between end users is effected in a manner that is transparent to the end users.
• the VPN Unit may be simulated in software which operates in conjunction with the communication software for connecting the remote client to the associated local Internet service provider.
• VPN Units will be described with reference to the following figures beginning with the flowchart of Figure 3.
• an endstation such as endstation 202 of LAN 205 at site 105
• its destination is to a remote site, other than the headquarters site 105
• the packet will proceed from the endstation 202 over the LAN 205 to the routing device 240 which will encapsulate the data packet in accordance with the Internet Protocol, forming an outbound IP packet.
• the IP packet On its way out of the site, the IP packet will pass through the associated VPN Unit for the site.
• the flowchart illustrated at Figure 3 shows the functional operation of a VPN Unit for an outbound packet that is received thereby.
• the Transmit Packet procedure 300 begins when the outbound data packet is received at the VPN Unit at step 310.
• decision box 320 it is determined whether or not the source and destination addresses for the data packet are both members of the same VPN group. This determination may be made with reference to lookup tables that are maintained by the VPN Units or reference to other memory mechanisms. This step may be thought of as member filtering for data packets being transmitted between the particular site and the VPN Unit which services it. If the source and destination address for the data packet are not both members of the same VPN group, then at step 330 the packet is forwarded to the Internet as ordinary Internet traffic from the site as though the VPN Unit were not involved. In which case, the procedure ends at step 335. In one alternative embodiment, it may be desirable to discard data traffic that is not destined between members of a VPN group rather than forwarding it as unsecure traffic. In another alternative embodiment, it may be desirable to provide the option to either pass or discard non- VPN-group data traffic.
• the data packet is processed at step 340 undergoing various combinations of compression, encryption and authentication.
• the lookup tables maintained by the VPN Unit 250 and all of the VPN Units in addition to identifying members of particular VPN groups, also identify whether or not data packets transferred between members of the particular VPN group are to be compressed and if so, what algorithm is to be used for compression.
• Many possible compression algorithms are well- known, but in one embodiment of the invention, LZW compression is implemented.
• the lookup table for the VPN group of which the source and destination addresses are members also identifies the particular encryption algorithm to be used for data packets traversing the Internet for that VPN group as well as the authentication and key management protocol information to be used thereby.
• the VPN Unit may be programmed to always use the same algorithms for all VPN groups.
• the particular packet processing algorithms to be used for VPN traffic may vary, so long as the lookup tables in both the sending and receiving VPN Units identify the same compression, encryption and authentication rules and are capable of implementing and deimplementing them for members of the same group. It is to be understood that a single VPN Unit may serve multiple VPN groups and that particular addresses may be members of multiple groups.
• the packet is processed according to the compression, encryption and authentication rules identified in the VPN Unit tables for that particular VPN group.
• the processed packet is forwarded toward the destination address over the Internet.
• the procedure of the sending VPN Unit then ends at step 355.
• the receiving VPN Unit reverses the above processes for VPN traffic as illustrated by the flowchart of Figure 4.
• the Receive Packet procedure 400 begins at step 410 when an inbound data packet is received from the Internet at the receiving VPN Unit.
• the inbound data packet is examined to determine if the source and destination addresses of the data packet are both members of the same VPN group. It is assumed that the lookup tables maintained by all of the VPN Units are both consistent and coherent. If the inbound data packet is determined not to be VPN traffic, then the packet is passed through and forwarded to the receiving site as though it were normal Internet data traffic at step 430. In which case the process ends at step 435. In one alternative embodiment it may be desirable to discard incoming data traffic that is not from an identified member of a VPN group supported by the VPNU.
• the VPN Unit will process the inbound packet to recover the original data packet as it was provided from the source endstation.
• the lookup table maintained by the receiving VPN Unit will identify the compression, encryption and authentication rules used for the VPN group and reconstruct the original IP packet in accordance with those rules at step 440. Then, the reconstructed packet will be delivered to the site of the destination address at 450 with the procedure ending at step 455.
• Figure 5 illustrates graphically the life cycle of the data packet sent between two members of the same VPN group. The data packet originates from a source 500 and propagates from the sources site through its associated router to generate IP data packet 510.
• the data packet 510 is not intended to illustrate all the fields associated with a complete IP data packet, but shows the relevant portions for this discussion which include the destination address, source address and the payload information of the packet.
• the data packet 510 is then examined by the VPN Unit which determines whether the data packet is traffic between members of an identified VPN group.
• the VPN Unit 520 processes the packet in accordance with the packet processing procedures described above with respect to Figure 3 with the resulting packet being illustrated as packet 530. Packet 530 still identifies the destination and source addresses of the data packet, but the remainder of the packet is encrypted, and optionally compressed.
• the data packet is propagated through the Internet to 550 with the destination and source information identifying to the associated routers of the Internet the path by which the packet should ultimately take to reach its destination.
• the packet emerges from the Internet at the edge of the destination site as data packet 540 which is essentially identical to the data packet 530.
• the packet is "deprocessed" by the receiving VPN Unit 550 which restores the original packet into its form 560 for delivery to the ultimate destination through the receiving site's associated router at destination 570.
• SKIP simple key management for Internet Protocol
• tunnel mode a mode of data transfer referred to as tunnel mode.
• the above described data transfer with respect to Figure 5 illustrates a transport mode of operation in which the data and source addresses are exposed as the data packet traverses the Internet.
• tunnel mode an added measure of security may be provided by encapsulating the entire data packet in another packet which identifies the source and destination addresses only for the VPN Units. This conceals the ultimate source and destination addresses in transit.
• Figure 6 illustrates the life cycle of a data packet being propagated from a source 600 to a destination 670 utilizing tunnel mode.
• the data packet 610 is processed by outbound VPN Unit 620 which generates a resulting packet 630.
• the resulting packet 630 encrypts and compresses (optionally) not only the data payload of the packet, but the destination and source addresses of the endstations as well.
• the encapsulated packet is then provided with an additional header that identifies that the source of the packet is the outbound VPN Unit 620 and that the destination is the inbound VPN Unit 650.
• the packet 640 which emerges from the Internet is identical to the packet 630 with respect to its source and address information and encapsulated payload.
• the packet is decomposed by the inbound VPN Unit 650 to reconstruct the original data packet at 660 for delivery to the destination 670.
• the overall architecture of the present invention is robust. It allows end users the convenience of proprietary data communications to take place over a public network space such as the Internet.
• the architecture of the present invention also allows a wide variety of compression, encryption and authentication technologies to be implemented, so long as the VPN Units at each end of the transaction support the associated protocols.
• the present invention is also capable of working in concert with traditional Internet security mechanisms such as corporate firewalls. A firewall might operate in series with the VPN Unit at a given site, or. intelligently be configured in a single box with the VPN Unit to provide parallel firewall and VPN Unit security functions.
• FIG. 7 there is illustrated a general block diagram for a virtual private network unit 700.
• the general architecture of the VPN Unit 700 is essentially that of a specially tailored personal computer (PC) apparatus architecture.
• the overall operation of the VPN Unit 700 is driven by a central processing unit (CPU) 705 which is coupled to communicate with the other components of the apparatus over a apparatus bus 710.
• the memory apparatus 720 is also illustrated as residing on the apparatus bus 710.
• Those of ordinary skill in the art will of course recognize that various memory configurations may be implemented, some of which may include a dedicated memory bus for higher speed throughput to the memory apparatus 720.
• the VPN Unit 700 is designed to be an intermediate device between a site's local area network and the Internet or other public network space.
• the VPN is designed to be an intermediate device between a site's local area network and the Internet or other public network space.
• the Unit 700 is illustrated as having an I/O controller 730 for coupling the VPN Unit 700 to the Internet or other public network space. Similarly, an I/O controller 740 is provided for coupling the VPN Unit 700 to the site's edge router. In accordance with the above-described functional requirements, the VPN Unit 700 resides between the site's router and the Internet. In this implementation, the I/O controller 740 is responsible for data packet transmissions between the router for the site and the VPN Unit 700.
• the VPN Unit 700 may be disposed between a site's local area network and its router, in which case the I/O controller 730 would be responsible for data packet transmissions between the VPN Unit 700 and the router, while the I/O controller 740 would effectively be the VPN Unit's interface to the local area network.
• data packet transmissions would probably have to be handled in accordance with the network protocol standard of the local area network rather than the public network space IP transmissions as described above.
• the general architecture for VPN Unit 700 illustrates that the two I/O controllers 730 and 740 are coupled to communicate over the apparatus bus 710 through I/O control logic 750.
• the I/O control logic 750 is responsible for arbitrating access to the apparatus bus for the data packets coming in and going out, and for assuring the necessary throughput for the data connections.
• the determination with respect to one embodiment requires interrogation of a look-up table, which maintains the identities of the various VPN groups serviced by the VPN Unit 700, as well as the group members and the various processing parameters for data packets that are exchanged between group members.
• this interrogation may be handled by the CPU 705 with reference to look-up tables that would be maintained in the memory apparatus 720.
• the VPN Unit 700 architecture includes a compression engine 760, coupled to communicate with the rest of the apparatus over the apparatus bus 710, and an encryption engine 770 similarly coupled to the apparatus bus 710.
• processing may be carried out by the CPU 705 with packets being assembled within the CPU 705 or at specified memory locations in the memory apparatus 720.
• logic may be inco ⁇ orated in the VPN Unit 700 designed specifically for the support of such key management protocols or other packet processing operations.
• VPN Unit 700 There is finally shown in the VPN Unit 700 architecture that optional I/O devices 780 may be interfaced to the VPN Unit 700 through I/O control logic 790. This may facilitate management of the unit either by allowing direct keyboard access to control the processor, or provide a-connection path for other communications devices which may need to communicate with the VPN Unit 700.
• I/O control logic 790 This may facilitate management of the unit either by allowing direct keyboard access to control the processor, or provide a-connection path for other communications devices which may need to communicate with the VPN Unit 700.
• FIG. 8 there is illustrated a more detailed block diagram for one implementation of a VPN Unit in accordance with one embodiment of the present invention.
• an architecture is disclosed which is driven by microprocessor 805, a 100 MHz Intel 486 DX4.
• the apparatus bus for this configuration is the VSIA bus 810 to which the other components of the apparatus are coupled.
• the memory apparatus in this case is supplied by several banks of fast dynamic random access memory (DRAM) 820.
• DRAM fast dynamic random access memory
• a PC chip set implementation from the Opti Co ⁇ oration is provided at 825 for controlling the overall operation of the apparatus.
• the Opti chip set as well as providing a apparatus controller functionality for the 486 DX4 microprocessor, may also be utilized to provide an interface to an optional ISA bus 828 to which other peripherals may be coupled to the apparatus.
• the I/O connections to the public network space 830 are provided by a series of multi -protocol transceivers with a DB-25 connector. Similarly, the connections for the private network side of the unit are provided through additional multi-protocol transceivers and an additional DB-25 connector.
• the I/O connections to the public and private networks are handled through a dual-port SCC 845 which includes a plurality of input and output buffers for transmission and receipt of data packets to the VPN Unit 800.
• the data packet I/O controller is coupled to the VSIA bus 810 through FPGA Control and Glue Logic 850.
• the compression engine for the implemented VPN Unit 800 is provided by an implementation of the STAC compression algorithm using the STAC chip 9710 compression engine 860, which is coupled to a dedicated bank of SRAM 865 to support its processing.
• the encryption engine is provided by a DES engine 870, which may be implemented in either an off- the-shelf special integrated circuit configuration or one designed to operate in accordance with the operation of the VPN Unit 800.
• the compression engine and encryption engine could be handled by software routines running on the microprocessor 805 or other general-purpose processing logic.
• Other alternative embodiments may use later generations of microprocessors which operate at higher speeds and may require implementation of a different apparatus bus such as the emerging PCI bus standard.
• Those of ordinary skill in the art will recognize alternative and various embodiments which may be designed to suit a particular pu ⁇ ose.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• General Engineering & Computer Science (AREA)
• Computing Systems (AREA)
• Computer Hardware Design (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Computer And Data Communications (AREA)
• Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)
• Mobile Radio Communication Systems (AREA)
• Circuits Of Receivers In General (AREA)
• Small-Scale Networks (AREA)
• Communication Control (AREA)

Priority Applications (5)

Applications Claiming Priority (2)

Publications (1)

Family

ID=25362958

Family Applications (1)

Country Status (9)

Cited By (12)

Families Citing this family (191)

Citations (2)

Family Cites Families (17)

• 1997
  • 1997-06-12 US US08/874,091 patent/US6173399B1/en not_active Expired - Lifetime
  • 1997-10-20 KR KR1019970053803A patent/KR100431956B1/ko not_active Expired - Fee Related
• 1998
  • 1998-06-11 CA CA002293435A patent/CA2293435C/en not_active Expired - Fee Related
  • 1998-06-11 AT AT98929021T patent/ATE355684T1/de not_active IP Right Cessation
  • 1998-06-11 DE DE69837201T patent/DE69837201T2/de not_active Expired - Lifetime
  • 1998-06-11 WO PCT/US1998/012226 patent/WO1998057464A1/en not_active Ceased
  • 1998-06-11 EP EP98929021A patent/EP0988736B1/en not_active Expired - Lifetime
  • 1998-06-11 JP JP50324399A patent/JP2002504285A/ja active Pending
  • 1998-06-11 AU AU80684/98A patent/AU8068498A/en not_active Abandoned

Patent Citations (2)

Non-Patent Citations (2)

Also Published As

Similar Documents

Legal Events