Raytheon Bbn Technologies Corp.

Raytheon Company

Partha Pal

Michael Hassan Atighetchi

Aaron Daniel Adler

Fusun Yaman-Sirin

Aaron Paulos

Jonathan Webb

Andrew Gronosky

Joseph Loyall

Richard E Schantz

Nathaniel Benjamin Soule

A system for performing security functions in a service-oriented computer system includes a router node configured to forward at least one packet of at least one service request to at least one server computer adapted to process the at least one service request; a first server node configured to execute, for the at least one packet, a first protocol layer of a network protocol stack, determine whether the at least one packet is compliant at the first protocol layer, and provide the at least one packet to a second server node responsive to determining that the at least one packet is compliant at the first protocol layer. The second server node is configured to execute, for the at least one packet, a second protocol layer of the network protocol stack, and determine whether the at least one packet is compliant at the second protocol layer.

System and method for protecting network-facing services

A method for performing security functions in a computer system hosting a network-facing server application includes receiving, by a service request processor, a service request to an application adapted to process the service request; responsive to the service request being a first request for the application to communicate over a network, processing the service request with a first process isolated in memory from the application; responsive to the service request being a second request for the application to access a physical storage device, processing the service request with a second process isolated in memory from the application; and responsive to a determination that the processed service request will not adversely affect the application, providing the processed service request to the application.

System and method for protecting service-level entities

Methods and systems for performing security functions in a service-oriented computer system are provided. The method includes acts of receiving, from one or more entities, a service request for a service provided by one or more server computers adapted to process the service request; providing a copy of the service request to a processor adapted to analyze the copy of the service request; storing the service request in a memory; determining, by the processor, if the service request should be processed by performing one or more analyzes of the copy of the service request to determine if the service request would be harmful to the one or more server computers; and if it is determined that the service request should be processed by the one or more server computers, forwarding the service request to the one or more server computers.

An architecture is provided for protecting service-level entities. Such an architecture may escrow service requests prior to forwarding the requests to the service, and checking may be performed prior to releasing the request to the service. A crumple zone (CZ) architecture may be provided that buffers incoming service requests and may intercept attacks and/or sustain damage in lieu of the services being protected. The CZ may include an outward interface that is accessed by other entities, and the underlying service is not accessed directly. Elements of the CZ receive service requests, analyze them, and determine whether they can be safely executed by the underlying service.

Growing community of inventors

Boxborough, MA, United States of America

Partha Pal