Network intrusion mitigation

• US 10,187,402 B2
• Filed: 11/25/2015
• Issued: 01/22/2019
• Est. Priority Date: 11/25/2015
• Status: Active Grant

• Current Assignee: EchoStar Technologies International Corporation (Echostar Corporation)
• Original Assignee: EchoStar Technologies International Corporation (Echostar Corporation)
• Inventors: Beals, William Michael
• Primary Examiner(s): Naghdali, Khalil
• Application Number:
  US14/952,479
• Publication Number:
  US 20170149806A1
• Time in Patent Office: 1,154 Days
• Field of Search: 726 4
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A request is received to reestablish a connection to an end device in a network. At least one datum is identified indicating an error condition, the at least one datum including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet. Based on the one or more data values, user input is requested to deny the reestablish connection request. In response to the user input, the end device is prevented from reestablishing a link on the network.

Claims

1. A device that includes a processor and a memory, the memory storing instructions executable by the processor such that the device is programmed to:

receive a reestablish connection request via a first user input to terminate and then reestablish a connection to an end device in a network;

identify at least one error condition, the at least one error condition including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet;

provide a confirmation request for a second user input to deny the reestablish connection request, wherein the confirmation request for the second user input to deny the reestablish connection request is triggered by identifying the at least one error condition; and

in response to the second user input, prevent the end device from reestablishing a link on the network.

2. The device of claim 1, wherein the network is a mesh network.

3. The device of claim 1, wherein the device is further programmed to:

reestablish the connection between the device and the end device, based upon the second user input.

4. The device of claim 1, wherein the device is further programmed to:

identify the BER by determining that a packet error rate for communications from the end device exceed a predetermined threshold.

5. The device of claim 4, wherein the device is further programmed to:

start a BER timer; and

determine when the BER timer exceeds a predetermined BER timer threshold.

6. The device of claim 1, wherein the device is further programmed to determine the RSSI value exceeds a predetermined threshold.

7. The device of claim 6, wherein the device is further programmed to:

start a RSSI timer; and

determine when the RSSI timer exceeds a predetermined RSSI timer threshold.

8. The device of claim 1, wherein the device is further programmed to:

identify the foreign packet by comparing an address of the foreign packet to a known address.

9. The device of claim 8, wherein the device is further programmed to:

start a foreign packet counter; and

determine when the foreign packet counter exceeds a predetermined foreign packet counter threshold.

10. The device of claim 1, wherein the device is a ZigBee coordinator.

11. A method comprising:

receiving a reestablish connection request via a first user input to terminate and then reestablish a connection to an end device in a network;

identifying at least one error condition, the at least one error condition including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet;

provide a confirmation request for a second user input to deny the reestablish connection request, wherein the confirmation request for the second user input to deny the reestablish connection request is triggered by identifying the at least one error condition; and

in response to the second user input, preventing the end device from reestablishing a link on the network.

12. The method of claim 11, wherein the network is a mesh network.

13. The method of claim 11, further comprising reestablishing the connection between the device and the end device, based upon the second user input.

14. The method of claim 11, further comprising:

identify the BER by determining that a packet error rate for communications from the end device exceed a predetermined threshold.

15. The method of claim 14, further comprising:

starting a BER timer; and

determining when the BER timer exceeds a predetermined BER timer threshold.

16. The method of claim 11, further comprising determining the RSSI value exceeds a predetermined threshold.

17. The method of claim 11, further comprising:

starting a RSSI timer; and

determining when the RSSI timer exceeds a predetermined RSSI timer threshold.

18. The method of claim 11, further comprising:

identifying the foreign packet by comparing an address of the foreign packet to a known address.

19. The method of claim 11, further comprising:

starting a foreign packet counter; and

determining when the foreign packet counter exceeds a predetermined foreign packet counter threshold.