US 6219706

Patent Overview — US 6219706 B1

Title: Access control for networks

Patent number: US 6219706 B1

Application number: US09/174,200

Inventors: Serene Fan; Steve Truong

Assignee: Cisco Technology, Inc. (original assignee; listed current assignee is Cisco Technology Inc)

Priority/filing date: 1998-10-16 (priority date listed as an assumption, not a legal conclusion)

Publication (grant) date: 2001-04-17

Legal status: Expired – Lifetime; anticipated expiration 2018-10-16

Purpose. The patent relates to network firewalls for controlling external access to a local network, and more particularly to firewalls having dynamic access control lists (ACLs). The stated aim is to protect networks from unauthorized accesses and to provide an access control system and method for controlling traffic to and from a local network, preferably implemented on a dedicated network device such as a router positioned between a local network and an external network, or between local networks.

Plain-language scope. Rather than relying only on static packet filtering, which checks packet headers against fixed ACL criteria, the described approach also inspects packet payload. Access control items are dynamically generated and removed based on the context of an application conversation. Channels through the firewall may be dynamically allocated based on knowledge of the application type and protocol, and packet payloads may be selectively examined to determine when new channels are about to be opened. The text distinguishes handling of SMTP (single channel, well-known port), FTP (well-known control channel plus data channels with arbitrary ports negotiated via the control channel), and H.323 (multiple control and data channels with arbitrary port numbers), noting static filtering handles such multi-channel protocols poorly.

Source: https://patents.google.com/patent/US6219706/en

What the excerpt does not establish. It does not provide the full claims, detailed description, or drawings; the full number and exact wording of claims are not shown, though claim-related terms appear in the keyword listing. It does not establish the identity or content of specific prior-art references beyond a citation to "Building Internet Firewalls" and a Check Point firewall implementation. It does not establish litigation, ownership transfers beyond the recorded assignment, validity, or a legal conclusion on status or dates. The excerpt notes some terms were truncated or omitted (e.g., protocol counts and subsequent text).