Network security device

• US 20020019933A1
• Filed: 05/25/2001
• Published: 02/14/2002
• Est. Priority Date: 01/03/1997
• Status: Abandoned Application

• Current Assignee: Aharon Friedman, Eva Bozoki
• Original Assignee: Aharon Friedman, Eva Bozoki
• Inventors: Friedman, Aharon, Bozoki, Eva
• Application Number:
  US09/866,460
• Publication Number:
  US 20020019933A1
• Time in Patent Office: Days
• US Class Current: 713/160
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2596 Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A network security device is connected between a protected client and a network. The network security device negotiates a session key with any other protected client. Then, all communications between the two clients are encrypted. The inventive device is self-configuring and locks itself to the IP address of its client. Thus, the client cannot change its IP address once set and therefore cannot emulate the IP address of another client. When a packet is transmitted from the protected host, the security device translates the MAC address of the client to its own MAC address before transmitting the packet into the network. Packets addressed to the host, contain the MAC address of the security device. The security device translates its MAC address to the client'"'"'s MAC address before transmitting the packet to the client.

Claims

1. A method for encrypting a data packet, comprising the steps of:

receiving the data packet at a first interface from a particular node, said packet having a header containing a source address and a first physical layer address of said particular node, said source address being an Internet address of said particular node;

replacing the first physical layer address in the received packet header with a second physical layer address;

determining a checksum verifing the packet;

saving the determined checksum in the packet; and

encrypting the packet including the checksum, but leaving the Internet address unencrypted and its position in the packet header unchanged.