US7093288B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Using packet filters and network virtualization to restrict network communications
Assignee: Microsoft Technology Licensing LLC
•
Filing: 2000-10-24
•
Granted: 2006-08-15
•
Expires: 2020-10-24
Abstract
Abstract A network mediator corresponding to a computing device uses packet filters to restrict network communications. The network mediator includes a set of one or more filters, each filter having parameters that are compared to corresponding parameters of a data packet to be passed through the network mediator. The network mediator determines whether to allow the data packet through based on whether the data packet parameters match any filter parameters. The set of filters can be modified by a remote device, but cannot be modified by the computing device whose communications are being restricted. When a data packet is sent from the computing device, the data packet will include the virtual address which is changed to the network address by the network mediator prior to forwarding the packet on the network, and vice versa. By virtualizing the addresses, the computing device is restricted in accessing other devices over the network.
Inventors
- 👤 Aamer Hydrie
- 👤 Galen C. Hunt
- 👤 Steven P. Levi
- 👤 Bassam Tabbara
- 👤 Robert V. Welland
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 17:02
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0236; H04L63/0263
Claims Analysis
Total Claims: 50
Claim 1
Independent Claim
238 words
A computing device comprising: a set of filters; a mapping of virtual addresses to network addresses; and a controller, coupled to the set of filters and the mapping, to, access, upon receipt of a data packet requested to be sent from the computing device to a target device via a network, the set of filters and determine whether the data packet can be sent to the target device based on whether the computing device is allowed to communicate with the target device, replace, based on the mapping, the target address in the data packet with a corresponding target network address; forward the data packet to the target device at the target network address if it is determined the data packet can be sent to the target device; prevent the computing device from modifying any of the filters in the set of filters, but allow the set of filters to be modified by a plurality of remote devices operating at a plurality of different managerial levels, a first of the plurality of remote devices being a cluster operations management console for managing hardware operations of the computing device, a second of the plurality of remote devices being an application operations management console for managing software operations of the computing device; and prevent the application operations management console from adding any filters to the set of filters that are less restrictive than filters added by the cluster operations management console.
Claim 2
Dependent Claim
238 words
A computing device comprising: a set of filters; a mapping of virtual addresses to network addresses; and a controller, coupled to the set of filters and the mapping, to, access, upon receipt of a data packet requested to be sent from the computing device to a target device via a network, the set of filters and determine whether the data packet can be sent to the target device based on whether the computing device is allowed to communicate with the target device, replace, based on the mapping, the target address in the data packet with a corresponding target network address; forward the data packet to the target device at the target network address if it is determined the data packet can be sent to the target device; prevent the computing device from modifying any of the filters in the set of filters, but allow the set of filters to be modified by a plurality of remote devices operating at a plurality of different managerial levels, a first of the plurality of remote devices being a cluster operations management console for managing hardware operations of the computing device, a second of the plurality of remote devices being an application operations management console for managing software operations of the computing device; and prevent the application operations management console from adding any filters to the set of filters that are less restrictive than filters added by the cluster operations management console.
Claim 3
Dependent Claim
39 words
A computing device as recited in claim 1 , wherein the controller is to make the computing device aware of the virtual addresses in the mapping but to hide the network addresses in the mapping from the computing device.
Claim 4
Dependent Claim
43 words
A computing device as recited in 1 , further comprising allowing the set of filters to be modified by a lower managerial level remote device only if the modifications are not less restrictive than modifications imposed by a higher managerial level remote device.
Claim 5
Dependent Claim
43 words
A computing device as recited in 1 , further comprising allowing the set of filters to be modified by a lower managerial level remote device only if the modifications are not less restrictive than modifications imposed by a higher managerial level remote device.
Claim 6
Dependent Claim
35 words
A computing device as recited in claim 1 , the computing device including a processor that supports multiple privilege levels, and the controller being implemented in a most privileged level of the multiple privilege levels.
Claim 7
Independent Claim
120 words
A method comprising: maintaining, at a computing device, a set of filters that restrict the ability of the computing device to communicate with other computing devices; allowing the set of fitters to be modified by a plurality of remote devices operating at a plurality of different managerial levels, the plurality of remote devices including a cluster operations management device for managing hardware operations of the computing device, and an application operations management device for managing software operations of the computing device; preventing the application operations management device from adding any filters to the set of filters that are less restrictive than filters added by the cluster operations management device; and preventing the computing device from modifying the set of filters.
Claim 8
Independent Claim
120 words
A method comprising: maintaining, at a computing device, a set of filters that restrict the ability of the computing device to communicate with other computing devices; allowing the set of fitters to be modified by a plurality of remote devices operating at a plurality of different managerial levels, the plurality of remote devices including a cluster operations management device for managing hardware operations of the computing device, and an application operations management device for managing software operations of the computing device; preventing the application operations management device from adding any filters to the set of filters that are less restrictive than filters added by the cluster operations management device; and preventing the computing device from modifying the set of filters.
Claim 9
Dependent Claim
39 words
A method as recited in claim 5 , wherein restriction of the ability of the computing device to communicate with other computing devices comprises restricting the computing device from transmitting data packets to one or more other computing devices.
Claim 10
Dependent Claim
51 words
A method as recited in claim 5 , wherein modification of the set of filters includes one or more of: adding a new filter to the set of filters, deleting a filter from the set of filters, and changing one or more parameters of a filter in the set of filters.
Claim 11
Dependent Claim
49 words
A method as recited in claim 5 , wherein one or more filters in the set of filters restrict one or more of the transmission of data packets of a particular type from the computing device and reception of data packets of a particular type at the computing device.
Claim 12
Dependent Claim
67 words
A method as recited in claim 5 , wherein one or more filters in the set of filters restrict one or more of the transmission of Internet Protocol (IP) data packets from the computing device and reception of IP data packets at the computing device based on one or more of: a source address, a destination IP address, a source port, a destination port, and a protocol.
Claim 13
Dependent Claim
65 words
A method as recited in claim 5 , wherein one or more filters in the set of filters identifies that a data packet targeting a particular address can be transmitted from the computing device to the addressed device, and further identifies a new address that the particular address from the data packet is to be changed to prior to being communicated to the addressed device.
Claim 14
Dependent Claim
46 words
A method as recited in claim 5 , wherein one of the filters in the set of filters is a permissive filter that indicates a data packet can be passed to its targeted destination device if the data packet parameters match corresponding parameters of the filter.
Claim 15
Dependent Claim
46 words
A method as recited in claim 5 , wherein one of the filters in the set of filters is an exclusionary filter that indicates a data packet cannot be passed to its targeted destination device if the data packet parameters match corresponding parameters of the filter.
Claim 16
Dependent Claim
30 words
A method as recited in claim 5 , wherein each filter includes a plurality of filter parameters, and wherein each of the plurality of filter parameters can include wildcard values.
Claim 17
Dependent Claim
77 words
A method as recited in claim 5 , wherein the set of filters restrict the ability of the computing device to communicate with other computing devices on a per-data packet basis, wherein each filter includes a plurality of filter parameters, and wherein each filter parameter includes a filter value and a mask value indicating which portions of the filter value must match a corresponding parameter in a data packet for the data packet to satisfy the filter.
Claim 18
Dependent Claim
24 words
One or more computer-readable memories containing a computer program that is executable by a processor to perform the method recited in claim 5 .
Claim 19
Dependent Claim
154 words
A network mediator comprising: a set of filters; and a controller, coupled to the set of filters, to, access, upon receipt of a data packet requested to be sent from a computing device to a target device via a network, the set of filters and determine whether the data packet can be sent to the target device based on whether the computing device is allowed to communicate with the target device, prevent the computing device from modifying any of the filters in the set of filters but allow the set of filters to be modified by a remote cluster operations management console for managing hardware operations of the computing device and by a remote application operations management console for managing software operations of the computing device, and prevent the remote application operations management console from modifying the set of filters to be less restrictive than filters added by the remote cluster operations management console.
Claim 20
Dependent Claim
154 words
A network mediator comprising: a set of filters; and a controller, coupled to the set of filters, to, access, upon receipt of a data packet requested to be sent from a computing device to a target device via a network, the set of filters and determine whether the data packet can be sent to the target device based on whether the computing device is allowed to communicate with the target device, prevent the computing device from modifying any of the filters in the set of filters but allow the set of filters to be modified by a remote cluster operations management console for managing hardware operations of the computing device and by a remote application operations management console for managing software operations of the computing device, and prevent the remote application operations management console from modifying the set of filters to be less restrictive than filters added by the remote cluster operations management console.
Claim 21
Dependent Claim
62 words
A network mediator as recited in claim 16 , wherein the controller is further to access, upon receipt of another data packet from another target device via the network, the set of filters and determine whether the data packet can be received at the computing device based on whether the computing device is allowed to receive communications from the other target device.
Claim 22
Dependent Claim
52 words
A network mediator as recited in claim 16 , wherein the modifying the set of filters includes one or more of: adding a new filter to the set of filters, deleting a filter from the set of filters, and changing one or more parameters of a filter in the set of filters.
Claim 23
Dependent Claim
19 words
A network mediator as recited in claim 16 , wherein the network mediator is coupled to the computing device.
Claim 24
Dependent Claim
17 words
A network mediator as recited in claim 16 , wherein the computing device includes the network mediator.
Claim 25
Dependent Claim
60 words
A network mediator as recited in claim 16 , wherein each filter in the set of filters includes a plurality of filter parameters, and wherein each filter parameter includes a filter value and a mask value indicating which portions of the filter value must match a corresponding parameter in the data packet for the data packet to satisfy the filter.
Claim 26
Dependent Claim
32 words
A network mediator as recited in claim 21 , wherein the controller is to allow the data packet to be forwarded to the target device if the data packet satisfies the filter.
Claim 27
Dependent Claim
32 words
A network mediator as recited in claim 21 , wherein the controller is to prevent the data packet from being forwarded to the target device if the data packet satisfies the filter.
Claim 28
Independent Claim
105 words
A method comprising: maintaining a set of filters that restrict the ability of a computing device to communicate with other computing devices; allowing multiple remote computing devices, each corresponding to a different managerial level, to modify the set of filters, the multiple remote computing devices including a cluster operations management device for managing hardware operations of the computing device, and an application operations management device for managing software operations of the computing device; and preventing the application operations management device from modifying the set of filters in a manner that would result in a violation of a filter added by the cluster operations management device.
Claim 29
Independent Claim
105 words
A method comprising: maintaining a set of filters that restrict the ability of a computing device to communicate with other computing devices; allowing multiple remote computing devices, each corresponding to a different managerial level, to modify the set of filters, the multiple remote computing devices including a cluster operations management device for managing hardware operations of the computing device, and an application operations management device for managing software operations of the computing device; and preventing the application operations management device from modifying the set of filters in a manner that would result in a violation of a filter added by the cluster operations management device.
Claim 30
Dependent Claim
79 words
A method as recited in claim 24 , wherein the preventing comprises: receiving a request from the application operations management device to modify the set of filters; determining whether the request to modify would result in a violation of a filter previously added to the set of filters by the cluster operations management device; and performing the request to modify when the request to modify would not result in a violation, and otherwise not performing the request to modify.
Claim 31
Independent Claim
42 words
A method as recited in 25 , wherein the request to modify comprises one or more of: adding a filter to the set of filters, modifying a filter in the set of filters, and deleting a filter from the set of filters.
Claim 32
Independent Claim
42 words
A method as recited in 25 , wherein the request to modify comprises one or more of: adding a filter to the set of filters, modifying a filter in the set of filters, and deleting a filter from the set of filters.
Claim 33
Dependent Claim
35 words
A method as recited in claim 24 , wherein the violation occurs when the request to modify would result in a filter being less restrictive than the filter added by the cluster operations management device.
Claim 34
Dependent Claim
20 words
A method as recited in claim 24 , further comprising preventing the computing device from modifying the set of filters.
Claim 35
Dependent Claim
77 words
A method as recited in claim 24 , wherein the set of filters restrict the ability of the computing device to communicate with other computing devices on a per-data packet basis, wherein each filter includes a plurality of filter parameters, and wherein each filter parameter includes a filter value and a mask value indicating which portions of the filter value must match a corresponding parameter in a data packet for the data packet to satisfy the filter.
Claim 36
Dependent Claim
24 words
One or more computer-readable memories containing a computer program that is executable by a processor to perform the method recited in claim 24 .
Claim 37
Dependent Claim
132 words
One or more computer-readable media having stored thereon a computer program to implement a multiple-level filter administration scheme and including a plurality of instructions that, when executed by one or more processors, causes the one or more processors to perform acts including: allowing a cluster operations management device for managing hardware operations of a filtered device to modify a set of filters corresponding to the filtered device, the cluster operations management device operating at a first of the multiple levels; and allowing an application operations management device for managing software operations of the filtered device to modify the set of filters only if the modification is at least as restrictive as the filters imposed by the first computing device, the application operations management device operating at a second of the multiple levels.
Claim 38
Dependent Claim
132 words
One or more computer-readable media having stored thereon a computer program to implement a multiple-level filter administration scheme and including a plurality of instructions that, when executed by one or more processors, causes the one or more processors to perform acts including: allowing a cluster operations management device for managing hardware operations of a filtered device to modify a set of filters corresponding to the filtered device, the cluster operations management device operating at a first of the multiple levels; and allowing an application operations management device for managing software operations of the filtered device to modify the set of filters only if the modification is at least as restrictive as the filters imposed by the first computing device, the application operations management device operating at a second of the multiple levels.
Claim 39
Dependent Claim
72 words
One or more computer-readable media as recited in claim 31 , wherein the plurality of instructions further include instructions that, when executed by the one or more processors, causes the one or more processors to perform acts including allowing the cluster operations management device to remove a filter from the set of filters imposed by the cluster operations management device but not allowing the application operations management device to remove the filter.
Claim 40
Dependent Claim
63 words
One or more computer-readable media as recited in claim 31 , wherein allowing the cluster operations management device or the application operations management device to modify the set of filters comprises one or more of: adding a new filter to the set of filters, removing a filter from the set of filters, and changing parameters of a filter in the set of filters.
Claim 41
Dependent Claim
48 words
One or more computer-readable media as recited in claim 31 , wherein the plurality of instructions further include instructions that, when executed by the one or more processors, causes the one or more processors to perform acts including preventing the filtered device from modifying the set of filters.
Claim 42
Independent Claim
194 words
A method comprising: maintaining an association of virtual addresses and corresponding network addresses; making a computing device aware of the virtual addresses; hiding the network addresses from the computing device; receiving, from the computing device, a data packet intended for a target computing device corresponding to a target virtual address; replacing, based on the target virtual address, the target virtual address with the corresponding target network address; forwarding the data packet to the target computing device at the target network address; maintaining, at the computing device, a set of filters that further restrict the ability of the computing device to communicate with other computing devices; allowing the set of filters to be modified from a plurality of remote devices, the plurality of remote devices including a cluster operations management device for managing hardware operations of the computing device and an application operations management device for managing software operations of the computing device; preventing the application operations management device from modifying the set of filters in a manner that would result in a violation of a filter added by the cluster operations management device; and preventing the computing device from modifying the set of filters.
Claim 43
Independent Claim
194 words
A method comprising: maintaining an association of virtual addresses and corresponding network addresses; making a computing device aware of the virtual addresses; hiding the network addresses from the computing device; receiving, from the computing device, a data packet intended for a target computing device corresponding to a target virtual address; replacing, based on the target virtual address, the target virtual address with the corresponding target network address; forwarding the data packet to the target computing device at the target network address; maintaining, at the computing device, a set of filters that further restrict the ability of the computing device to communicate with other computing devices; allowing the set of filters to be modified from a plurality of remote devices, the plurality of remote devices including a cluster operations management device for managing hardware operations of the computing device and an application operations management device for managing software operations of the computing device; preventing the application operations management device from modifying the set of filters in a manner that would result in a violation of a filter added by the cluster operations management device; and preventing the computing device from modifying the set of filters.
Claim 44
Dependent Claim
20 words
A method as recited in claim 35 , wherein the replacing comprises performing the replacing transparent to the computing device.
Claim 45
Dependent Claim
61 words
A method as recited in claim 35 , further comprising: receiving, from a source device, another data packet that is intended for the computing device, wherein the other data packet includes a network address of the source device; and replacing, based on the network address of the source device, the network address of the source device with a corresponding virtual address.
Claim 46
Dependent Claim
24 words
One or more computer-readable memories containing a computer program that is executable by a processor to perform the method recited in claim 35 .
Claim 47
Dependent Claim
196 words
A network mediator comprising: a mapping of virtual addresses to network addresses; a set of filters that restrict the ability of the computing device to communicate with other computing devices; and a controller, coupled to the mapping, to, make a corresponding computing device aware of the virtual addresses, hide the network addresses from the computing device, receive, from the computing device, a data packet intended for a target computing device corresponding to a target virtual address, replace, based on the target virtual address, the target virtual address with the corresponding target network address, forward the data packet to the target computing device at the target network address, allow the set of filters to be modified from a plurality of remote devices, the plurality of remote devices including a cluster operations management device for managing hardware operations of the computing device and an application operations management device for managing software operations of the computing device, prevent the application operations management device from modifying the set of filters in a manner that would result in a violation of a filter added by the cluster operations management device, and prevent the computing device from modifying the set of filters.
Claim 48
Dependent Claim
196 words
A network mediator comprising: a mapping of virtual addresses to network addresses; a set of filters that restrict the ability of the computing device to communicate with other computing devices; and a controller, coupled to the mapping, to, make a corresponding computing device aware of the virtual addresses, hide the network addresses from the computing device, receive, from the computing device, a data packet intended for a target computing device corresponding to a target virtual address, replace, based on the target virtual address, the target virtual address with the corresponding target network address, forward the data packet to the target computing device at the target network address, allow the set of filters to be modified from a plurality of remote devices, the plurality of remote devices including a cluster operations management device for managing hardware operations of the computing device and an application operations management device for managing software operations of the computing device, prevent the application operations management device from modifying the set of filters in a manner that would result in a violation of a filter added by the cluster operations management device, and prevent the computing device from modifying the set of filters.
Claim 49
Dependent Claim
20 words
A network mediator as recited in claim 39 , wherein the network mediator is communicatively coupled to the computing device.
Claim 50
Dependent Claim
17 words
A network mediator as recited in claim 39 , wherein the computing device includes the network mediator.
References Cited (Backward Citations)
US5031089A
Cited
US5220621A
Cited
US5430810A
Cited
US5475817A
Cited
US6115393A
Cited
US5895499A
Cited
US5872914A
Cited
US6510154B1
Cited
US5801970A
Cited
US6634141B2
Cited
US5768271A
Cited
US5748958A
Cited
US5948055A
Cited
US6519615B1
Cited
US6804783B1
Cited
US5845277A
Cited
US6111993A
Cited
US5826015A
Cited
US6151688A
Cited
US6353898B1
Cited
US6338112B1
Cited
US6598173B1
Cited
US6070243A
Cited
US6108699A
Cited
US6389464B1
Cited
US5960371A
Cited
US6141749A
Cited
US6606708B1
Cited
US6263089B1
Cited
US6449641B1
Cited
US6192401B1
Cited
US6047325A
Cited
US6178529B1
Cited
US6125447A
Cited
US6484261B1
Cited
US6496187B1
Cited
US6366578B1
Cited
US6208345B1
Cited
US6311144B1
Cited
US6694436B1
Cited
US6259448B1
Cited
WO1999063439A1
Cited
EP0962861A2
Cited
US6360265B1
Cited
US6427163B1
Cited
US6466932B1
Cited
US6266707B1
Cited
US6717949B1
Cited
US6324571B1
Cited
US6230312B1
Cited
US6728885B1
Cited
US6212559B1
Cited
US6393456B1
Cited
US6651101B1
Cited
US6336171B1
Cited
US6393474B1
Cited
US6691168B1
Cited
US6510509B1
Cited
US6564261B1
Cited
US6470332B1
Cited
EP1063815A2
Cited
US6549516B1
Cited
US6466984B1
Cited
US6584499B1
Cited
US6480955B1
Cited
US6466978B1
Cited
US6684335B1
Cited
US6587876B1
Cited
US6487622B1
Cited
US6609148B1
Cited
US6615256B1
Cited
US6529953B1
Cited
US6769008B1
Cited
US6862613B1
Cited
US6493715B1
Cited
US6754716B1
Cited
US20010019554A1
Cited
US6601101B1
Cited
US6748447B1
Cited
US6801937B1
Cited
US20020095524A1
Cited
US6718379B1
Cited
US6609213B1
Cited
US6907395B1
Cited
US20020194369A1
Cited
US20030154404A1
Cited
US20030041139A1
Cited
US20030120763A1
Cited
US20030126230A1
Cited
US20030206548A1
Cited
US6801528B2
Cited
US20040078787A1
Cited
US20040054791A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2009-08-14 | 2010-02-13 | 2010-08-15 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2013-08-14 | 2014-02-13 | 2014-08-15 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2017-08-14 | 2018-02-13 | 2018-08-15 | $7700.00 | Window Closed / Lapsed |