Geographic Filter For Regulating Inbound and Outbound Network Communications

Abstract

A system and method for regulating and analyzing inbound and outbound communications in and between computer networks on the basis of geographic security assertions are provided. Geographic information is collected, optimized, and shared between network objects to enforce network access control on the basis of configurable security assertions. Security assertions are configured and metrics displayed using maps and other geographic data in a graphical user interface.

What is claimed is: 
     
         1 . A geographic filter device transmitting on a network comprising:
 a. a first network object capable of receiving data from or transmitting data to a second network object;   b. a user interface engine wherein geographic rules and configuration criteria are displayed, a user interacts with the device, views its operation, and alters, changes, and sets configuration criteria;   c. a functional input engine wherein input types are loaded, parsed, and processed and correspond with the transcoding-parsing engine;   d. a configuration post-processing engine wherein a set of configuration functions relating to input, input optimization, and communication of processed configuration directives;   e. a transcoding-parsing engine wherein input is received from said configuration post-processing engine to process the run-time input media;   f. a geographic filtering engine wherein all communication between said first network object and said second network object must pass through said geographic filter engine;   g. a network filtering engine wherein a set of network functions are performed based on the input received from said geographic filtering engine;   h. a transcoding-output engine wherein input from said network filtering engine said transcoding-parsing engine is received, a set of functions are applied to said input, and said information is sent to the reporting engine; and   i. a reporting engine wherein information is received from said transcoding-output engine and reports are created and sent to a destination via a network communication protocol operation.   
     
     
         2 . The device in  claim 1 , wherein said functional input engine further comprises:
 a. a media interface module opens, reads, and retrieves media input based on the desired media type; and   b. a loader module loads media input into memory for processing by the transcoding-parsing engine.   
     
     
         3 . The device in  claim 1 , wherein said configuration post-processing engine further comprises:
 a. a module to receive input from said user interface engine;   b. a module to optimize said input wherein configuration information is converted into generic device instructions; and   c. a module to output said optimized input to the transcoding-parsing engine.   
     
     
         4 . The device in  claim 1 , wherein said transcoding-parsing engine further comprises:
 a. a parser-configuration module receives input from said configuration post-processing engine and sets the input mode and output mode;   b. a parser-input module interoperates with said loader module and encodes portions of the run-time input media received based on the mode set by the parser-configuration module; and   c. a parser-output module propagates the parsed said run-time input media to said geographic filtering engine.   
     
     
         5 . The device in  claim 1 , wherein said geographic filtering engine further comprises:
 a. a geofilter control module controls the application of logical, arithmetic, and associative functions;   b. an associative module processes information on request by the geofilter control module;   c. a rules abstraction module contains a compact representation of security assertions in the form of low-level constituents; and   d. a dispatch module reports the result of geographic filtering engine to the network filtering engine.   
     
     
         6 . The device in  claim 1 , wherein said network filtering engine further comprises a responder module responding to a datagram. 
     
     
         7 . The device in  claim 1 , wherein said network filtering engine further comprises a packet filter module performing an action upon the incoming data packet as determined by the rules abstraction module. 
     
     
         8 . The device in  claim 7 , wherein said network filtering engine further comprises a responder module responding to a datagram. 
     
     
         9 . The device in  claim 8 , wherein said responder module operates in parallel with said packet filter module. 
     
     
         10 . The device in  claim 6 , wherein said responder module responds to the datagram by:
 a. blocking a particular piece of network information;   b. allowing a particular unit of network information to traverse the network with its intended destination;   c. redirecting the network information to a user-specified network, network node or subnet;   d. logging the network information or a subset of the information; or   e. sending network information to a network node.   
     
     
         11 . The device in  claim 1 , wherein said network filtering engine further comprises a logger module generating logs. 
     
     
         12 . The device in  claim 1 , wherein said transcoding-output engine further comprises:
 a. an output parser module receives input from said network filtering engine and generates a log function; and   b. an output feed module formats information derived from said log function and said information is sent to the reporting engine.   
     
     
         13 . The device in  claim 1 , wherein said reporting engine further comprises:
 a. an input parser wherein input data is formatted;   b. an output coordinator wherein formatted input data received from said input parser is sent based on configurations in said user interface engine and includes the following functions:
 determining the output channel to send said formatted input data; 
 determining to propagate said formatted input data to said user interface module; 
 determining where and how said formatted input data is stored; and 
 initiating remote contact among other systems and servers during the reporting process when network communications are necessary for the reporting functions, storage of data, or retrieval of data; 
   c. a storage module wherein data generated by said geographic filtering engine is stored; and   d. a user interface module wherein device configuration criteria and geographic filter operations are displayed to a user and a user interacts with the device.   
     
     
         14 . The device in  claim 13 , wherein said storage module is a computer readable medium capable of warehousing data. 
     
     
         15 . The device in  claim 13 , wherein said user interface module displays device operation and a user can alter, change and set configuration values and criteria. 
     
     
         16 . The device in  claim 15 , wherein said configuration values and criteria comprises:
 a. channel through which updates to the device occur;   b. when the updates to the device occur;   c. source of updates to the device; or   d. types of sources that update the device.   
     
     
         17 . The device in  claim 16 , wherein said types of sources is an automated threat feed. 
     
     
         18 . The device in  claim 15 , wherein said configuration values and criteria comprises IP address ranges of protected network objects. 
     
     
         19 . The device in  claim 15 , wherein said configuration values and criteria comprises geographic filter thresholds. 
     
     
         20 . The device in  claim 19 , wherein said geographic filter thresholds comprises a dynamic transition between whitelists and blacklists. 
     
     
         21 . The device in  claim 13 , wherein said user interface module comprises an interactive graphical user interface (GUI). 
     
     
         22 . The device in  claim 20 , wherein said interactive GUI is a geographic map. 
     
     
         23 . The device in  claim 22 , wherein said geographic map comprises a zoom in and zoom out feature on geographic perspectives. 
     
     
         24 . The device in  claim 23 , wherein said geographic perspectives is a world map with continent borders. 
     
     
         25 . The device in  claim 23 , wherein said geographic perspectives is world map with country borders. 
     
     
         26 . The device in  claim 23 , wherein said geographic perspectives is an user-defined perspective using customized resource identifiers. 
     
     
         27 . The device in  claim 1 , wherein said destination is a network node. 
     
     
         28 . The device in  claim 1 , wherein said reporting engine formats reports in a generic format as determined by operational parameters and writes files to a local file system. 
     
     
         29 . The device in  claim 1 , wherein said reporting engine formats reports in a generic format as determined by operational parameters and writes files to a remote file system. 
     
     
         30 . The device in  claim 29 , wherein said remote file system is a threat feed. 
     
     
         31 . The device in  claim 29 , wherein said remote file system is an automated threat feed. 
     
     
         32 . The device in  claim 1 , wherein said network communication protocol operation comprises an open database connectivity operation.