Patent Application
20070300298
The following detailed description of the embodiments of the invention will be more readily understood when taken in conjunction with the following drawings, wherein:
For the purposes of promoting an understanding of the principles of the invention, a schematic diagram of the AHPDM system of the present invention is shown in
As used here in, the term “Descriptor Tags” refers to data which describes traffic characteristics, contains information observed or learned about source and destination of traffic, contains information observed or learned about content of traffic, and combinations thereof.
As used here in, the term “Channel Tags” refers to data that contains routing information on traffic flow, identifies desired channel and combinations thereof. “Channel Tags” may be encoded as a binary tag at front of packet or as a specific radio frequency or lambda of light.
As used here in, the term “Label Switch” refers to a hardware or software device which acts on Channel Tags to direct traffic to a given Channel, load balances traffic to different channels of the same type, adds or removes channel tags, and combinations thereof. In a preferred embodiment, and not meant to be limiting, “Label Switches” typically will not add or remove descriptor tags and/or modify traffic. Label switches can be selected as optical cross connects, copper switches, component modules, software and combinations thereof.
As used here in, the term “Label Router” refers to a hardware or software device which may integrate with internal and external information sources to characterize data and/or use data analysis or characterization tools and which may add, remove, and/or modify descriptor and channel tags on data packages. In a preferred embodiment, and not meant to be limiting, “Label Routers” typically will not block, restrict or drop packets or balance loads on the network.
As used here in, the term “Policy Enforcement Device” refers to a hardware or software device which blocks, restricts, directs and shapes traffic flows by applying policy to channel tags and descriptor tags. As such, “Policy Enforcement Devices” may change channel tags. In a preferred embodiment, and not meant to be limiting, “Policy Enforcement Devices” typically will not block, restrict or drop packets, balance loads on the network, or modify, add or remove Descriptor tags.
As shown in the Figure, traffic from the internet 1 first encounters policy enforcement devices 100. These policy enforcement devices 100 interrogate the data stream on the network to determine the presence of predetermined characteristics associated with the sensitivity of each of the portions of data within the data stream. The policy enforcement devices 100 are the outer edge of a border policy domain 70 in which policies are enforced for traffic entering the intranet 61 from the Internet 1.
Policy enforcement devices 100 may then either quarantine the data, discard the data, or route the data to one or more label edge routers 200. Label routers 200 include system analysis tools 201, which may be integrated intrusion detection systems (IDS), statistical analysis tools or combinations there of. System analysis tools 201 characterize at least one of the portions of data, based upon the portion of data exhibiting a predetermined combination of characteristics, wherein a predetermined combination of characteristics is related to the sensitivity of the portion of data.
Data is then passed from the label edge routers 200 to one or more label switches 300. The label switches direct the traffic based on the tags applied by the label routers 200. If additional analysis has been deemed necessary by the label routers 200 then the label switches 300 send the data to one or more additional label routers 400 that may apply additional analysis if required or pass data through without modification to tags. Additional analysis is done through the use of either internally integrated or externally integrated data analysis tools 401, which may be but not necessarily the same as system analysis tools 201. As shown in
Data is then passed by label routers 400 to policy enforcement devices 500 in a plurality of different channels, wherein each of the channels is associated with different levels of sensitivity. Policy enforcement devices 500 may then either quarantine the data, discard the data, or route the data out of the policy domain 70 to the intranet core 61. The policy enforcement devices 500 determine if the data is allowed to enter the Intranet core 61 based on the information supplied by the label routers 400 and 200.
Label switches 60 inside the Intranet core 61 interprets the tags and channels of the network traffic and, based on this interpretation, sends the network traffic either to the Internet policy domain 70 or the computer systems policy domain 80.
Policy Enforcement devices 600 in the computer systems policy domain 80 interpret the tags and channels associated with the data flows and, based on the policy for the policy domain, determines if the network traffic is allowed from the intranet core 61.
Policy enforcement devices 600 either allow or deny the traffic from the label switches 60. If allowed the data is sent to label routers 700. If not allowed by the policy enforcement devices 600, the traffic is either dropped or quarantined. Label routers 700 may apply additional analysis on the data flows through the use of security analysis tools 701 before passing traffic out of the computer system policy domain 80 to traditional network switches. Security analysis tools 701 may be the same as but not necessarily the same as data analysis tools 401 and/or system analysis tools 201.
If Label router 700 is attached to a traditional ethernet switch 800 it will strip all tags or channel information that had been previously applied to network traffic and send traffic to the traditional Ethernet switch 800. The Ethernet switch 800 then directs the traffic accordingly to computer systems 801.
If traffic is destined for label aware equipment, label router 700 sends it traffic to label switch 810. Label Switch 810 directs the traffic to label aware computer systems 811 that are capable of interpreting the labels and tags that had been applied by label routers 200, 400, and 700.
Computer systems 811 then may apply their own individual policies based on the analysis and information that has been provided in the form of tags, labels or channel information.
Continuing with
As shown in
Label edge routers 200 add a descriptor based on enforcement of policy for policy domain 70. These descriptors 10 indicate the sensitivity of that data package. Based on the analysis, the label router applies a channel ID 11 to the data package. This channel ID 11 may be a digital tag that represents a channel number which result in the traffic being routed in the form of a different wave length or a specific physical channel of a physical medium.
The label switches 300 interpret the channel ID tags and direct the data packet to additional label routers 400 if necessary or to the policy enforcement device 500. If additional analysis is required then label router 400 may modify the channel ID 11 and descriptors 12 to reflect the outcome of its analysis. As such as descriptors 12 typically will contain the same information as descriptors 10 except descriptors 12 will have tags encoding the additional analysis.
The traffic is then sent to policy enforcement devices 500 which then enforce policies based on descriptors 12 and channel id 11. Based on the enforcement of policy it may reassign a new channel ID 13 and add additional information about its enforcement of the policy by modification of the descriptors 14. As such as descriptors 14 typically will contain the same information as descriptors 10 and/or descriptors 12, except descriptors 14 will have tags encoding the additional analysis.
Data is directed through the internet core 61 by the label switches 60 based on the channel ID 13. Policy enforcement devices 600 receive the traffic and apply the policy from policy domain 80 to the traffic based on their interpretation of the channel ID 13 and the descriptors 14. Based on their interpretation policy enforcement devices 600 will modify the channel ID 15 and the descriptors 14 before sending the data to the label routers 700.
Label routers 700 will determine if they the destination of the data is label aware or only data package aware. If the data destination is a non-label aware computer system 801 then it will remove channel ID 15 and descriptors 14 before it sends the packet 20 to the network switch 800.
If Label routers 700 determine that they data is destined to a label aware device or computer system 811 then they may modify channel ID 15 to and descriptors 14 to reflect any additional analysis before sending packet 30 to the label switch 810. Label switch 810 interprets the channel ID 15 and sends the data to the correct label aware system 811.
While a preferred embodiment of the present invention has been shown and described, it will be apparent to those skilled in the art that many changes and modifications may be made without departing from the invention in its broader aspects. The appended claims are therefore intended to cover all such changes and modifications as fall within the true spirit and scope of the invention.
The invention was made with Government support under Contract DE-AC0676RLO 1830, awarded by the U.S. Department of Energy. The Government has certain rights in the invention.
