US 5606668

Patent Overview — US5606668A

Title: System for securing inbound and outbound data packet flow in a computer network

Patent number / application: US5606668A (application US08/168,041)

Inventor: Gil Shwed

Assignee: Check Point Software Technologies Ltd. (original and current assignee listed)

Key dates: Priority/filing date 1993-12-15; granted/publication date 1997-02-25; anticipated expiration 2014-02-25. Legal status shown as "Expired – Lifetime." Related priority filings listed for EP, DE, CA, JP, PCT, and US08/664,839.

Purpose: The patent relates to controlling computer network security, specifically an easily alterable or expandable method for controlling information flow to and from internal and external destinations. It addresses the conflict between connectivity and security by using packet filtering to permit connectivity while controlling traffic and blocking illegal communication attempts.

Plain-language scope: The disclosed method operates a network passing data as packets. It involves: generating definitions of each network aspect controlled by a security rule; defining the security rule in terms of those aspect definitions; converting the rule into a set of filter-language instructions; and providing a packet filter module in at least one network entity. The module emulates a packet filtering module, reads and executes the instructions, and either accepts (passes) or rejects (drops) each packet. A further aspect stores results and uses stored results in the accept/reject decision. Objects include controlling flow from/to internal and external destinations, examining every packet passing a node, and providing a generic packet filter controlled by instructions so an administrator can alter security policy without changing the filter itself or writing extensive code.

Figures (as listed): network topology (FIG. 1); security system applied to topology (FIG. 2); administrator screen (FIG. 3); graphical-information-to-filter-script conversion (FIG. 4); information flow (FIG. 5); packet filter operation (FIG. 6); virtual machine operations (FIG. 7).

Source: https://patents.google.com/patent/[US5606668](/patent/US5606668)/en

What the excerpt does not establish: It does not provide the full claims, complete description, all prior-art references, or the detailed operation of figures. It does not establish litigation, ownership transfers, validity, or prior-art comparisons. Legal status is noted as an assumption, not a legal conclusion.