Patent US6496935B1 successfully refreshed from Google Patents.
US6496935B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
System, device and method for rapid packet filtering and processing
Assignee: Check Point Software Technologies Ltd
•
Filing: 2000-03-02
•
Granted: 2002-12-17
•
Expires: 2020-03-02
Abstract
Abstract A system, a device and a method for accelerating packet filtration by supplementing a firewall with a pre-filtering module. The pre-filtering module performs a limited set of actions with regard to the packets, according to whether the packets are received from a connection which has been previously permitted by the firewall. If the packets are received from such a permitted connection, then the pre-filtering module forwards the packets to their destination, optionally performing one or more actions on the packets. Otherwise, the packets are forwarded to the firewall for handling. Preferably, once the firewall has transferred responsibility for the connection to the pre-filtering module, or “off-loaded” the connection, the firewall does not receive further packets from this connection until a timeout occurs for the connection, or a packet is received with particular session-control field values, such that the connection is closed. Optionally and preferably, the pre-filtering module is implemented as hardware.
Inventors
- 👤 Gonen Fink
- 👤 Amir Harush
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 21:14
CPC Classifications
H; H04; H04L; H04L12/00; H04L12/02; H04L12/22; H04L63/00; H04L63/02; H04L63/0227; H04L63/0254; H04L63/14; H04L63/1441; H04L63/1466
Claims Analysis
Total Claims: 34
Claim 1
Independent Claim
113 words
A system for accelerated packet filtering, the system comprising: (a) a source node for transmitting a packet; (b) a destination node for receiving said packet; (c) a firewall interposed between said source node and said destination node for performing packet filtering according to at least one rule; and (d) a pre-filtering module separate from said firewall and being in communication with said firewall, for receiving at least one instruction from said firewall and for receiving said packet before said firewall, such that if said packet is permitted according to said at least one instruction, said pre-filtering module handles said packet, and alternatively said pre-filtering module forwards said packet to said firewall for handling.
Claim 2
Independent Claim
113 words
A system for accelerated packet filtering, the system comprising: (a) a source node for transmitting a packet; (b) a destination node for receiving said packet; (c) a firewall interposed between said source node and said destination node for performing packet filtering according to at least one rule; and (d) a pre-filtering module separate from said firewall and being in communication with said firewall, for receiving at least one instruction from said firewall and for receiving said packet before said firewall, such that if said packet is permitted according to said at least one instruction, said pre-filtering module handles said packet, and alternatively said pre-filtering module forwards said packet to said firewall for handling.
Claim 3
Dependent Claim
62 words
The system of claim 1 , wherein packet transmission between said source node and said destination node forms a connection, and said firewall determines whether said connection is permitted, such that said at least one instruction includes at least one parameter of said packet for identifying a permitted connection, such that if said connection is permitted, said pre-filtering module handles said packet.
Claim 4
Dependent Claim
29 words
The system of claim 2 , wherein said firewall receives a packet from said permitted connection from said pre-filtering module if said packet has a selected session-control field value.
Claim 5
Dependent Claim
28 words
The system of claim 2 , wherein said at least one parameter for identifying said permitted connection includes a source address and a destination address for said packet.
Claim 6
Dependent Claim
29 words
The system of claim 4 , wherein said at least one parameter for identifying said permitted connection further includes a source port and a destination port for said packet.
Claim 7
Dependent Claim
32 words
The system of claim 2 , wherein if an additional packet has not been received for said permitted connection after a predefined period of time, said connection is deleted by said firewall.
Claim 8
Dependent Claim
36 words
The system of claim 2 , wherein if a packet with a particular session-control field value indicative of information about a connection state is received for said permitted connection, said packet is forwarded to said firewall.
Claim 9
Dependent Claim
31 words
The system of claim 2 , wherein said pre-filtering module further comprises: (i) a connection database for storing said at least one parameter of said packet for identifying said permitted connection.
Claim 10
Dependent Claim
42 words
The system of claim 8 , wherein said pre-filtering module further comprises: (ii) a classification engine for analyzing at least a portion of said packet and for comparing said at least a portion of said packet to said at least one parameter.
Claim 11
Dependent Claim
47 words
The system of claim 9 , wherein said pre-filtering module further comprises: (iii) a modifier for performing at least one action on said packet if said packet is received from said permitted connection, said at least one action being defined according to an instruction from said firewall.
Claim 12
Dependent Claim
16 words
The system of claim 10 , wherein said pre-filtering module is implemented as a hardware device.
Claim 13
Dependent Claim
34 words
The system of claim 10 , further comprising: (e) a computational device interposed between said source node and said destination node, wherein said pre-filtering module and said firewall are operated by said computational device.
Claim 14
Independent Claim
106 words
A system for accelerated filtering of a packet on a network, the system comprising: (a) a firewall located on the network for performing packet filtering on the packet according to at least one rule; and (b) a pre-filtering module, separate from said firewall, located on the network and in communication with said firewall, for receiving at least one instruction from said firewall, said at least one instruction determining a simple comparison, and for receiving a packet transmitted on the network before said firewall, such that if the packet is permitted according to said simple comparison, said pre-filtering module at least transmits the packet on the network.
Claim 15
Independent Claim
106 words
A system for accelerated filtering of a packet on a network, the system comprising: (a) a firewall located on the network for performing packet filtering on the packet according to at least one rule; and (b) a pre-filtering module, separate from said firewall, located on the network and in communication with said firewall, for receiving at least one instruction from said firewall, said at least one instruction determining a simple comparison, and for receiving a packet transmitted on the network before said firewall, such that if the packet is permitted according to said simple comparison, said pre-filtering module at least transmits the packet on the network.
Claim 16
Dependent Claim
46 words
The system of claim 13 , wherein if the packet is not permitted, said pre-filtering module either forwards the packet to said firewall for handling if the packet is received from the network, and alternatively drops the packet if the packet is received from said firewall.
Claim 17
Dependent Claim
86 words
The system of claim 13 , further comprising: (c) a source node for transmitting the packet; and (d) a destination node for receiving the packet; wherein packet transmission between said source node and said destination node forms a connection, and said firewall determines whether said connection is permitted, such that said at least one instruction includes at least one parameter of the packet for identifying a permitted connection, such that if said connection is permitted, said pre-filtering module at least transmits the packet on the network.
Claim 18
Dependent Claim
21 words
The system of claim 15 , wherein if said connection is not a permitted connection, said pre-filtering module drops the packet.
Claim 19
Dependent Claim
116 words
For use in a system for accelerated packet filtration, the system featuring a network for transmitting a packet and a firewall on the network for filtering the packet, a pre-filtering module for receiving the packet before the firewall, the pre-filtering module comprising: (a) a memory for storing at least one instruction for analyzing at least one parameter of the packet from the firewall, said at least one instruction including said at least one parameter for identifying the packet; and (b) a classification engine for analyzing at least a portion of the packet and for comparing said at least a portion of the packet to said at least one parameter according to said at least one instruction.
Claim 20
Dependent Claim
116 words
For use in a system for accelerated packet filtration, the system featuring a network for transmitting a packet and a firewall on the network for filtering the packet, a pre-filtering module for receiving the packet before the firewall, the pre-filtering module comprising: (a) a memory for storing at least one instruction for analyzing at least one parameter of the packet from the firewall, said at least one instruction including said at least one parameter for identifying the packet; and (b) a classification engine for analyzing at least a portion of the packet and for comparing said at least a portion of the packet to said at least one parameter according to said at least one instruction.
Claim 21
Dependent Claim
43 words
The pre-filtering module of claim 17 , further comprising: (c) a modifier for performing at least one action on the packet if the packet is permitted, said at least one action being declined according to said at least one instruction from the firewall.
Claim 22
Independent Claim
61 words
A method for accelerated packet filtering on a network in conjunction with a firewall, the method comprising the steps of: (a) providing a pre-filtering module for receiving a packet before the firewall; (b) receiving said packet by said pre-filtering module; (c) determining whether said packet is permitted; and (d) if said packet is permitted, handling said packet by said pre-filtering module.
Claim 23
Independent Claim
61 words
A method for accelerated packet filtering on a network in conjunction with a firewall, the method comprising the steps of: (a) providing a pre-filtering module for receiving a packet before the firewall; (b) receiving said packet by said pre-filtering module; (c) determining whether said packet is permitted; and (d) if said packet is permitted, handling said packet by said pre-filtering module.
Claim 24
Dependent Claim
19 words
The method of claim 19 , further comprising the step of: (e) alternatively, forwarding said packet to the firewall.
Claim 25
Dependent Claim
19 words
The method of claim 20 , wherein step (e) is performed if said packet is received from the network.
Claim 26
Dependent Claim
18 words
The method of claim 21 , wherein if said packet is received from the firewall, dropping said packet.
Claim 27
Dependent Claim
20 words
The method of claim 19 , wherein step (d) includes the step of marking said packet with a priority number.
Claim 28
Dependent Claim
52 words
The method of claim 19 , wherein if the packet is received as a plurality of fragments, step (d) includes the step of determining if a fragment is a duplicate fragment, such that if said fragment is a duplicate fragment, the method further comprises the step of: (e) dropping said duplicate fragment.
Claim 29
Dependent Claim
21 words
The method of claim 19 , wherein step (c) is determined according to at least one instruction received from the firewall.
Claim 30
Dependent Claim
28 words
The method of claim 25 , wherein said packet has a destination address and wherein step (d) includes the step of forwarding said packet to said destination address.
Claim 31
Dependent Claim
39 words
The method of claim 26 , wherein step (d) includes the step of performing at least one action on said packet by said pre-filtering module, said at least one action being determined according to an instruction from the firewall.
Claim 32
Dependent Claim
52 words
The method of claim 25 , wherein said packet features at least one parameter, and said at least one instruction identifies said packet as a permitted packet according to said at least one parameter, such that step (c) includes the step of analyzing said packet to retrieve said at least one parameter.
Claim 33
Dependent Claim
76 words
The method of claim 28 , wherein the firewall classifies at least one previously received packet according to at least a source address and a destination address of said at least one previously received packet, said source address and said destination address together forming a connection, such that the firewall sends said source address and said destination address for identifying said connection as a permitted connection to said pre-filtering module as said at least one instruction.
Claim 34
Dependent Claim
70 words
The method of claim 29 , wherein the network communicates with a plurality of interfaces, and pre-filtering module is connected to each of said plurality of interfaces, such that step (c) includes the step of determining whether said packet is received from said permitted connection and from a permitted interface, such that said packet is permitted only if said packet is received from said permitted connection through said permitted interface.
References Cited (Backward Citations)
US5400331A
Cited
US5802320A
Cited
US5878231A
Cited
US5884025A
Cited
US5648965A
Cited
US6147976A
Cited
US5828833A
Cited
US6304975B1
Cited
US6073178A
Cited
US6208651B1
Cited
US6092108A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2005-12-16 | 2006-06-17 | 2006-12-17 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2009-12-16 | 2010-06-17 | 2010-12-17 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2013-12-16 | 2014-06-17 | 2014-12-17 | $7700.00 | Window Closed / Lapsed |