Methods, apparatus and program product for controlling network security

• US 20040022186A1
• Filed: 07/30/2002
• Published: 02/05/2004
• Est. Priority Date: 07/30/2002
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Noel, Francis Edward Jr., Kump, Garry Michael
• Application Number:
  US10/208,281
• Publication Number:
  US 20040022186A1
• Time in Patent Office: Days
• US Class Current: 370/229
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Methods, apparatus and program products which monitor access points through which data can be exchanged with a network, identify an unauthorized access point, and selectively apply filters to the flow of data through an unauthorized access point.

Claims

1. A method comprising the steps of:

monitoring access points through which data can be exchanged with a network, identifying an unauthorized access point,

monitoring traffic passing through the identified unauthorized access point, and

applying traffic filtering to monitored traffic passing through the identified unauthorized access point.

2. A method according to claim 1 wherein the step of monitoring comprises intermittently and periodically querying network nodes for recent entries into node identifying connectivity tables maintained at the nodes.

3. A method according to claim 2 wherein the step of monitoring comprises querying network nodes at predetermined regular intervals.

4. A method according to claim 2 wherein the step of monitoring comprises querying network nodes at random irregular intervals.

5. A method according to claim 1 wherein the step of applying traffic filtering comprises denying access to the network through the identified unauthorized access point.

6. A method according to claim 1 wherein the step of applying traffic filtering comprises directing traffic exchanged with the network through the identified unauthorized access point to a secure server.

7. A method comprising the steps of:

querying access points through which data can be exchanged with a network and gathering connectivity table information from a queried access point,

reporting through the network to a server computer system the information gathered by querying,

identifying an unauthorized access point by operation of the server system, and

selectively applying a filter to the traffic exchanged with the network though the identified unauthorized access point.

8. Apparatus comprising:

a server computer system,

a network interface connected to said system and providing a communication channel between said system and a network,

an access point identification program stored accessibly to said system and cooperating therewith when executing to identify unauthorized nodes accessible through said interface, and

a traffic filter controlling program stored accessibly to said system and cooperating therewith when executing to selectively impose a filter on traffic exchanged with the network through an unauthorized node.

9. Apparatus according to claim 8 wherein said traffic filter controlling program is effective to revise connectivity tables stored in the network and deny network access to an unauthorized node.

10. Apparatus according to claim 8 wherein said traffic filter controlling program is effective to reroute traffic exchanged with the network through the unauthorized node to a secure server.

11. A program product comprising:

a computer readable medium; and

a program stored on said medium accessibly to a computer system, said program when executing on a system;

monitoring access points through which data can be exchanged with a network, identifying an unauthorized access point,

monitoring traffic passing through the identified unauthorized access point, and

applying traffic filtering to monitored traffic passing through the identified unauthorized access point.

12. A program product comprising:

a computer readable medium; and

a program stored on said medium accessibly to a computer system, said program when executing on a system;

querying access points through which data can be exchanged with a network and gathering connectivity table information from a queried access point,

reporting through the network to a server computer system the information gathered by querying,

identifying an unauthorized access point by operation of the server system, and

selectively applying a filter to the traffic exchanged with the network though the identified unauthorized access point.