Method, system, and computer program product for restricting access to a network using a network communications device

• US 20040022242A1
• Filed: 07/31/2002
• Published: 02/05/2004
• Est. Priority Date: 07/31/2002
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Bhogal, Kulvir Singh, Ishmael, Nizamudeen Jr., Sidhu, Mandeep Singh
• Granted Patent: US 7,248,563 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A system, method, and computer program product are disclosed for restricting access to a network using a network communications device. The network communications device includes multiple ports for providing access to a data processing system to the network. A specification of one of the multiple ports is received. A specification of a time period is also received. Access to the network is then blocked through the specified port during the specified time period.

Claims

1. A method in a data processing system, said method comprising the steps of:

providing a network communications device that includes multiple ports for providing access to a network;

receiving a specification of one of said multiple ports;

receiving a specification of a time period; and

blocking access to said network through said one of said multiple ports during said time period.

2. The method according to claim 1, further comprising the steps of:

storing said specified one of said multiple ports in a database in said network communication device;

storing said specified time period in said database in said network communication device; and

associating said specified one of said multiple ports with said specified time period together in said database.

3. The method according to claim 1, further comprising the steps of:

receiving, within said network communications device, a network packet;

identifying one of said multiple ports through which said network packet was received;

determining whether said one of said multiple ports through which said network packet was received is said specified one of said multiple ports;

determining whether a current time is within said time period; and

in response to a determination that said one of said multiple ports through which said network packet was received is said specified one of said multiple ports and that said current time is within said time period, discarding said network packet.

4. The method according to claim 1, further comprising the step of:

receiving, within said network communications device, a network packet;

identifying one of said multiple ports through which said network packet was received;

determining whether said one of said multiple ports through which said network packet was received is said specified one of said multiple ports;

determining whether a current time is within said time period; and

in response to a determination that either said one of said multiple ports through which said network packet was received is not said specified one of said multiple ports or that said current time is not within said time period, forwarding said network packet to said network.

5. The method according to claim 1, further comprising the steps of:

receiving, within said network communications device, a network packet;

identifying one of said multiple ports through which said network packet was received;

determining whether said one of said multiple ports through which said network packet was received is said specified one of said multiple ports;

determining whether a current time is within said time period;

in response to a determination that said one of said multiple ports through which said network packet was received is said specified one of said multiple ports and that said current time is within said time period, discarding said network packet;

determining a media access control (MAC) address of a computer system that transmitted said network packet;

storing said MAC address within said network communications device; and

storing an identification of said one of said multiple ports through which said network packet was received with said stored MAC address.

6. The method according to claim 5, further comprising the steps of:

receiving a second packet;

identifying a second one of said multiple ports through which said second packet was received;

determining whether said second one of said multiple ports is said specified one of said multiple ports;

determining a time period associated with said second one of said multiple ports;

determining whether a current time is within said determined time period;

determining a media access control (MAC) address of a computer system that transmitted said second packet;

in response to a determination that either said second one of said multiple ports is not said specified one of said multiple ports or that said current time is not within said determined time period, determining whether said MAC address of said computer system that transmitted said second packet is stored in said network communications device; and

in response to a determination that said MAC address of said computer system that transmitted said second packet is stored in said network communications device, discarding said second packet.

7. The method according to claim 6, further comprising the step of in response to a determination that said MAC address of said computer system that transmitted said second packet is not stored in said network communications device, forwarding said second packet.

8. The method according to claim 1, wherein said network communications device is a router.

9. The method according to claim 1, wherein said network communications device is a switch.

10. The method according to claim 1, wherein said network communications device is a hub.

11. The method according to claim 1, further comprising the steps of:

specifying a media access control (MAC) address of a computer system which is to be restricted from accessing said network;

storing said MAC address in a database that is included in a memory in a said network communications device.

12. The method according to claim 11, further comprising the steps of:

storing said specification of one of said multiple ports in a second database within said communications device; and

storing said specification of said time period in said second database.

13. A data processing system comprising:

a network communications device that includes multiple ports for providing access to a network;

said network communications device including a CPU executing code for receiving a specification of one of said multiple ports;

said CPU executing code for receiving a specification of a time period; and

said network communications device for blocking access to said network through said one of said multiple ports during said time period.

14. The system according to claim 13, further comprising:

a database in said network communication device for storing said specified one of said multiple ports;

said database for storing said specified time period; and

said CPU executing code for associating said specified one of said multiple ports with said specified time period together in said database.

15. The system according to claim 13, further comprising:

said network communications device for receiving a network packet;

said CPU executing code for identifying one of said multiple ports through which said network packet was received;

said CPU executing code for determining whether said one of said multiple ports through which said network packet was received is said specified one of said multiple ports;

said CPU executing code for determining whether a current time is within said time period; and

in response to a determination that said one of said multiple ports through which said network packet was received is said specified one of said multiple ports and that said current time is within said time period, said network communications device discarding said network packet.

16. The system according to claim 13, further comprising:

said network communications device for receiving a network packet;

said CPU executing code for identifying one of said multiple ports through which said network packet was received;

said CPU executing code for determining whether said one of said multiple ports through which said network packet was received is said specified one of said multiple ports;

said CPU executing code for determining whether a current time is within said time period; and

in response to a determination that either said one of said multiple ports through which said network packet was received is not said specified one of said multiple ports or that said current time is not within said time period, said network communications device forwarding said network packet to said network.

17. The system according to claim 13, further comprising:

said network communications device for receiving a network packet;

said CPU executing code for identifying one of said multiple ports through which said network packet was received;

said CPU executing code for determining whether said one of said multiple ports through which said network packet was received is said specified one of said multiple ports;

said CPU executing code for determining whether a current time is within said time period;

in response to a determination that said one of said multiple ports through which said network packet was received is said specified one of said multiple ports and that said current time is within said time period, said network communications device discarding said network packet;

said CPU executing code for determining a media access control (MAC) address of a computer system that transmitted said network packet;

said network communications device for storing said MAC address; and

said network communications device for storing an identification of said one of said multiple ports through which said network packet was received with said stored MAC address.

18. The system according to claim 17, further comprising:

said network communications device for receiving a second packet;

said CPU executing code for identifying a second one of said multiple ports through which said second packet was received;

said CPU executing code for determining whether said second one of said multiple ports is said specified one of said multiple ports;

said CPU executing code for determining a time period associated with said second one of said multiple ports;

said CPU executing code for determining whether a current time is within said determined time period;

said CPU executing code for determining a media access control (MAC) address of a computer system that transmitted said second packet;

in response to a determination that either said second one of said multiple ports is not said specified one of said multiple ports or that said current time is not within said determined time period, said CPU executing code for determining whether said MAC address of said computer system that transmitted said second packet is stored in said network communications device; and

in response to a determination that said MAC address of said computer system that transmitted said second packet is stored in said network communications device, said network communications device discarding said second packet.

19. The system according to claim 18, further comprising in response to a determination that said MAC address of said computer system that transmitted said second packet is not stored in said network communications device, said network communications device forwarding said second packet.

20. The system according to claim 13, further comprising said network communications device being a router.

21. The system according to claim 13, further comprising said network communications device being a switch.

22. The system according to claim 13, further comprising said network communications device being a hub.

23. The system according to claim 13, further comprising:

said CPU executing code for receiving a specified media access control (MAC) address of a computer system which is to be restricted from accessing said network;

a database included in a memory in a said network communications device for storing said MAC address.

24. The system according to claim 23, further comprising:

a second database included within said communications device for storing said specification of one of said multiple ports; and

said specification of said time period being stored in said second database.

25. A computer program product in a data processing system, said computer program product comprising:

instruction means for providing a network communications device that includes multiple ports for providing access to a network;

instruction means for receiving a specification of one of said multiple ports;

instruction means for receiving a specification of a time period; and

instruction means for blocking access to said network through said one of said multiple ports during said time period.

26. The product according to claim 25, further comprising:

instruction means for storing said specified one of said multiple ports in a database in said network communication device;

instruction means for storing said specified time period in said database in said network communication device; and

instruction means for associating said specified one of said multiple ports with said specified time period together in said database.

27. The product according to claim 25, further comprising:

instruction means for receiving, within said network communications device, a network packet;

instruction means for identifying one of said multiple ports through which said network packet was received;

instruction means for determining whether said one of said multiple ports through which said network packet was received is said specified one of said multiple ports;

instruction means for determining whether a current time is within said time period; and

in response to a determination that said one of said multiple ports through which said network packet was received is said specified one of said multiple ports and that said current time is within said time period, instruction means for discarding said network packet.

28. The product according to claim 25, further comprising:

instruction means for receiving, within said network communications device, a network packet;

instruction means for identifying one of said multiple ports through which said network packet was received;

instruction means for determining whether said one of said multiple ports through which said network packet was received is said specified one of said multiple ports;

instruction means for determining whether a current time is within said time period; and

in response to a determination that either said one of said multiple ports through which said network packet was received is not said specified one of said multiple ports or that said current time is not within said time period, instruction means for forwarding said network packet to said network.

29. The product according to claim 25, further comprising:

instruction means for receiving, within said network communications device, a network packet;

instruction means for identifying one of said multiple ports through which said network packet was received;

instruction means for determining whether said one of said multiple ports through which said network packet was received is said specified one of said multiple ports;

instruction means for determining whether a current time is within said time period;

in response to a determination that said one of said multiple ports through which said network packet was received is said specified one of said multiple ports and that said current time is within said time period, instruction means for discarding said network packet;

instruction means for determining a media access control (MAC) address of a computer system that transmitted said network packet;

instruction means for storing said MAC address within said network communications device; and

instruction means for storing an identification of said one of said multiple ports through which said network packet was received with said stored MAC address.

30. The product according to claim 29, further comprising:

instruction means for receiving a second packet;

instruction means for identifying a second one of said multiple ports through which said second packet was received;

instruction means for determining whether said second one of said multiple ports is said specified one of said multiple ports;

instruction means for determining a time period associated with said second one of said multiple ports;

instruction means for determining whether a current time is within said determined time period;

instruction means for determining a media access control (MAC) address of a computer system that transmitted said second packet;

instruction means responsive to a determination that either said second one of said multiple ports is not said specified one of said multiple ports or that said current time is not within said determined time period, for determining whether said MAC address of said computer system that transmitted said second packet is stored in said network communications device; and

instruction means responsive to a determination that said MAC address of said computer system that transmitted said second packet is stored in said network communications device, for discarding said second packet.

31. The product according to claim 30, further comprising instruction means responsive to a determination that said MAC address of said computer system that transmitted said second packet is not stored in said network communications device, for forwarding said second packet.

32. The product according to claim 25, wherein said network communications device is a router.

33. The product according to claim 25, wherein said network communications device is a switch.

34. The product according to claim 25, wherein said network communications device is a hub.

35. The product according to claim 25, further comprising:

instruction means for specifying a media access control (MAC) address of a computer system which is to be restricted from accessing said network;

instruction means for storing said MAC address in a database that is included in a memory in a said network communications device.

36. The product according to claim 35, further comprising:

instruction means for storing said specification of one of said multiple ports in a second database within said communications device; and

instruction means for storing said specification of said time period in said second database.

37. A method for restricting access to a port of a network device, comprising:

accessing a password protected interface to the network device through a Web page; and

designating, through the interface, at least one port of the network device to be blocked for specified time periods.

38. A system for restricting access to a port of a network device, comprising:

a Web page for accessing a password protected interface to the network device; and

the interface for designating at least one port of the network device to be blocked for specified time periods.

39. A computer program product for restricting access to a port of a network device, comprising:

instruction means for accessing a password protected interface to the network device through a Web page; and

instruction means for designating, through the interface, at least one port of the network device to be blocked for specified time periods.