US 8572717

Patent Overview: US8572717B2

Title: Dynamic access control policy with port restrictions for a network security appliance

Patent number: US8572717B2 | Application: US12/261,512 | Publication: US20100095367A1

Inventor: Krishna Narayanaswamy | Assignee: Juniper Networks, Inc. (original and current)

Dates: Priority date 2008-10-09; filing date 2008-10-30; granted/publication date 2013-10-29. Status listed as Active with adjusted expiration 2030-04-12 (the source notes legal status is an assumption, not a legal conclusion).

Purpose: The invention relates to computer networks, and more particularly to detection and prevention of attacks in computer networks. It addresses a gap: typical firewalls and intrusion detection systems associate applications with static layer-four port assignments, but malicious users employ dynamic or randomized ports to evade detection, and may spoof one application type (e.g., an HTTP request) while using another (e.g., Peer-to-Peer) to bypass a security appliance.

Plain-language scope: A network security appliance receives a packet flow and supports a security policy specifying (a) match criteria including a layer-seven network application and a static port list of one or more layer-four ports for a transport-layer protocol, and (b) actions for matching flows. A rules engine dynamically identifies the layer-seven application type by inspecting application-layer data in packet payloads—not based solely on header layer-four port—then applies the policy to determine whether the flow matches the static port lists, and if so, applies the specified actions. Configuration may be received via a user interface. The excerpt also describes a corresponding method and a computer-readable medium containing instructions. Stated advantages include improved firewall/IDP services where applications use dynamic or randomized ports, and preventing resource waste from undesired peer-to-peer applications.

Source: https://patents.google.com/patent/[US8572717](/patent/US8572717)/en

What the excerpt does not establish: The text is explicitly an excerpt with omitted portions. It does not provide the full claims, the complete written description, the exact number of claims, dependent-claim structure, or a full figure listing. It does not establish prosecution history, the scope of any specific claim as allowed, or the identity of any prior-art references beyond the general background discussion (no specific references are cited here). No litigation, ownership-transfer, or validity information is addressed, and the source itself cautions that assignee listings, priority dates, and legal status are assumptions rather than legal conclusions. The excerpt ends mid-sentence, so the listed advantages are incomplete.