Secured network arrangement and methods thereof

Patent metadata

Field	Value
Publication number	US-9813448-B2
Application number	US-201313944795-A
Country	US
Kind code	B2
Filing date	Jul 17, 2013
Priority date	Feb 26, 2010
Publication date	Nov 7, 2017
Grant date	Nov 7, 2017

Abstract

A high density network arrangement for managing an integrated secured multiple networks arrangement is provided. The arrangement includes a power module for providing power to a circuitry of the high density network arrangement. The arrangement also includes a plurality of network interfaces, wherein each network interface of the plurality of network interfaces is configured for coupling with a network arrangement. The arrangement further includes a processor for providing processing capability to the high density network arrangement. The arrangement yet also includes logic arrangement for managing data traffic flowing through the plurality of network interfaces, wherein the data traffic is configured to traverse the high density network arrangement between the plurality of network arrangement interfaces irrespective whether the power is provided to the circuitry of the high density network arrangement.

First claim

What is claimed is:

1. A high density network arrangement for managing an integrated secured multiple networks arrangement, comprising:
a plurality of network interfaces, wherein each network interface of said plurality of network interfaces is configured for coupling with a network arrangement;
a dual bypass module for protecting data traffic flowing through said plurality of network interfaces while providing network access by: tapping, at a network tap, said data traffic and sending tapped data traffic to a monitoring system on a path between the network tap and the monitoring system; testing a condition of the monitoring system and the path between the network tap and the monitoring system by sending one or more sets of sequential heartbeat packets to the monitoring system; and bypassing the monitoring system in response to detecting a negative condition of the monitoring system or the path between the network tap and the monitoring system based on a negative response or lack of response from the monitoring system to the one or more sets of sequential heartbeat packets; and
a logic module for managing policies for setting a security mode between said high density network arrangement and the monitoring system and for modifying a heartbeat packet of the one or more sets of sequential heartbeat packets sent to the monitoring system for a diagnostic test by adding network information, to the heartbeat packet, about data traffic flowing through said high density network, wherein the network information comprises an alarm status based on a utilization rate of the high density network arrangement.

2. The high density network arrangement of claim 1 wherein said logic module is a field programmable gate array (FPGA).

3. The high density network arrangement of claim 2 wherein said logic module is configurable.

4. The high density network arrangement of claim 1 wherein said security mode includes a bypass mode and a normal mode.

5. The high density network arrangement of claim 4 wherein a data path is established between said high density network arrangement and each network arrangement thereby enabling resource sharing between said high density network arrangement and said each network arrangement.

6. The high density network arrangement of claim 4 wherein a set of data paths is provided between at least two network arrangements when said at least two network arrangements are coupled to said high density network arrangement, thereby enabling resource sharing between said at least two network arrangements.

7. The high density network arrangement of claim 1 wherein said network information includes a status field, wherein said status field specifies the security mode between said high density network arrangement and the monitoring system.

8. The high density network arrangement of claim 1 wherein said network information includes a command field, wherein said command field provides at least a direct communication path between said monitoring system and said plurality of network interfaces, and wherein the logic module is configured for receiving a responsive heartbeat packet from the monitoring system and retrieving, from a matching command field of the responsive heartbeat packet, instructions for handling a problematic heartbeat packet.

9. The high density network arrangement of claim 1 further comprises, logic arrangement for managing said data traffic flowing through said plurality of network interfaces, wherein said logic arrangement includes grouping between ports of different network arrangement of said integrated secured multiple networks arrangement, wherein said grouping provides for minimizing time delay for deactivating a set of links between a first network arrangement and a second network arrangement of said integrated secured multiple networks arrangement when a data path between said first network arrangement and said second network arrangement is unavailable.

10. A method for integrating multiple network arrangements into a single integrated secured arrangement, comprising:
providing a high density network arrangement for managing said single integrated secured arrangement;
directing data traffic through a set of network interfaces, each network interface of said set of network interfaces enabling a network device to couple with said high density network arrangement;
protecting said data traffic through said set of network interfaces while providing network access by using a dual bypass module for: tapping, at a network tap, said data traffic and sending tapped data traffic to a monitoring system on a path between the network tap and the monitoring system; testing a condition of the monitoring system and the path between the network tap and the monitoring system by sending one or more sets of sequential heartbeat packets to the monitoring system; and bypassing the monitoring system in response to detecting a negative condition of the monitoring system or the path between the network tap and the monitoring system based on a negative response or lack of response from the monitoring system to the one or more sets of sequential heartbeat packets;
managing policies for setting a security mode between said high density network arrangement and the monitoring system by modifying a heartbeat packet of the one or more sets of sequential heartbeat packets sent to the monitoring system for a diagnostic test by adding network information, to the heartbeat packet, about said data traffic flowing through said high density network, wherein the network information comprises an alarm status based on a utilization rate of the high density network arrangement; and
utilizing logic arrangement for sharing resources across said high density network arrangement and said multiple network arrangements, wherein said sharing including at least one of
establishing a set of control paths between said high density network arrangement and said multiple network arrangements; and
establishing a set of data paths between said high density network arrangement and said multiple network arrangements.

11. The method of claim 10 wherein said setting said security mode includes switching said security mode between a normal mode and a bypass mode.

12. The method of claim 11 wherein said security mode is set automatically based on the network information provided to said monitoring system, wherein said network information includes a status field and a command field.

13. The method of claim 10 wherein said directing of said data traffic through said set of network interfaces includes performing grouping between ports of different network arrangement of said single integrated secured arrangement, wherein said grouping provides for minimizing time delay for deactivating a set of links between a first network arrangement and a second network arrangement of said multiple networks arrangement when a data path between said first network arrangement and said second network arrangement is unavailable.

14. A high density network arrangement for enabling network resource sharing within an integrated secured network environment, comprising:
a plurality of network interfaces configured for coupling with a set of network arrangements, wherein said plurality of network interfaces being configured for receiving and sending data traffic within said integrated secured network environment;
a dual bypass module for protecting said data traffic flowing through said plurality of network interfaces while providing network access by: tapping, at a network tap, said data traffic and sending tapped data traffic to a monitoring system on a path between the network tap and the monitoring syste

Assignees

• Matityahu Eldad
• Shaw Robert
• Carpio Dennis
• Hui Siuman
• Lian Wei
• Ixia

Inventors

• Matityahu Eldad
• Shaw Robert
• Carpio Dennis
• Hui Siuman
• Lian Wei

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L43/50

  Testing arrangements · CPC title

• H04L41/0668

  by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L43/12

  Network monitoring probes · CPC title