John T Mchenry, 785002 Dodson Dr, Annandale, VA 22003

6615358, Sep 2, 2003

Apr 7, 1999

09/287655

Patrick W. Dowd - Columbia MD, 21044
John T. McHenry - Odenton MD, 21113

G06F 1130

713201, 370229, 37039552

The present invention is a device for and method of accessing an information network by initializing a database, an ATM approved list, an IP approved list, and an IP disapproved list; receiving a datagram; discarding the datagram if it is not on the ATM approved list; determining the datagrams type; allowing access to the network and comparing the connection request, if any, to the database if the datagram is ATM signaling; discarding the datagram if the datagram is ATM signaling and the database denies the request; adding the request to the ATM approved list if the datagram is ATM signaling and the database allows the request; allowing access to the network if the datagram is ATM data that excludes IP data and the request is on the ATM approved list; computing a flow tag if the datagram is ATM data that includes IP data; discarding the datagram if the flow tag is on the IP disapproved list; allowing access to the network if the flow tag is on the IP approved list; comparing the flow tag to the database if the flow tag is neither on the IP approved list nor on the IP disapproved list; discarding the datagram and adding the flow tag to the IP disapproved list if the database rejects the flow tag; and allowing access to the network and adding the flow tag to the corresponding approved list if the database accepts the flow tag; and performing these steps on the next datagram.

7073196, Jul 4, 2006

Apr 7, 1999

09/287654

Patrick W. Dowd - Columbia MD, US
John T. McHenry - Odenton MD, US

The United States of America as represented by the National Security Agency - Washington DC

G06F 11/30
G06F 15/16
H04L 12/56

726 14, 37039552, 726 4, 709223

The present invention is a device for and method of accessing a network by initializing a database, an approved list, and a disapproved list; receiving an connectionless network packet; computing a flow tag based on the connectionless network packet; discarding the connectionless network packet and returning to the second step if the flow tag is on the disapproved list; allowing access to the network and returning to the second step if the flow tag is on the approved list; comparing the flow tag to the database if the flow tag is not on the approved list or the disapproved list; discarding the connectionless network packet, adding the flow tag to the disapproved list, and returning to the second step if the database rejects the flow tag; and allowing access to the network, adding the flow tag to the approved list, and returning to the second step if the database accepts the flow tag.

6141755, Oct 31, 2000

Apr 13, 1998

9/059041

Patrick William Dowd - Columbia MD
John Thomas Mchenry - Odenton MD

The United States of America as represented by the Director of the
National Security Agency - Washington DC

G06F 1100

713200

A network firewall security apparatus that enables a very high degree of traffic selectability yet avoids the usual performance penalty associated with firewalls. This approach is specific to high-speed circuit switched networks, Asynchronous Transfer Mode (ATM) networks in particular. Security management is achieved through active connection management with authentication, better suited to the cell-based environment of high-speed circuit switched networks and to the mix of circuit switched traffic, where Internet Protocol (IP) datagrams comprise a fraction of the total traffic. The information in the signaling cells is used to determine which flows, rather than which individual cells, are allowed to pass through the firewall. A hierarchical method has been devised, in which the physical location of the interrelated components may be decoupled. Active connection management is applied in determining the approval of a connection based on signaling information and network state information.