Security apparatus and method for local area networks

• US 20040049586A1
• Filed: 10/22/2002
• Published: 03/11/2004
• Est. Priority Date: 09/11/2002
• Status: Active Grant

• Current Assignee: Sysxnet Ltd.
• Original Assignee: Wholepoint Corp. (Singapore Telecommunications Limited)
• Inventors: Dziadziola, David A., Ocepek, Steven R., Lauer, Brian A.
• Granted Patent: US 7,124,197 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

The present invention includes a method and apparatus for controlling data link layer access to protected servers on a computer network by a client device. Address resolution requests broadcast on the network by the client device seeking access to any network device are received and then processed to determine whether the client device is unknown. If the client device is unknown, restriction address resolution replies are transmitted to the protected devices to restrict access by the client device to the protected devices and allow access to an authentication server. The authentication server is monitored to determine if the client device is authorized or unauthorized by the authentication server. If the client device is authorized, access is allowed to the protected devices. If the client device is unauthorized, blocking address resolution replies are transmitted on the computer network to block access by the client device to all other network devices.

Claims

1. A method for blocking access to one or more protected devices each having a physical device address on a computer network by a client device having a physical device address, comprising the steps of:

(a) receiving address resolution requests broadcast on the network by the client device seeking access to one of the protected devices;

(b) processing the address resolution requests to determine whether the client device is an unknown device;

(c) if the client device is unknown as determined in step (b), transmitting address resolution replies on the computer network to block access to the protected devices and allow access to an authentication server;

(d) if the client device is unknown as determined in step (b), monitoring the authentication server to determine if the client device is authorized or unauthorized by the authentication server;

(e) if the client device is authorized as determined in step (d), allowing access to the protected devices; and

(f) if the client device is unauthorized as determined in step (d), transmitting blocking address resolution replies on the computer network to block access to the protected devices.

2. The method recited in claim 1, wherein the restriction address resolution replies contain a source physical device address corresponding to the physical device address of the client device, an is-at physical device address different than the physical device address of the client device, and a destination physical device address corresponding to the physical device address of one of the protected devices.

3. The method recited in claim 2, wherein the is-at physical device address is a randomly changing physical device address pre-determined to not be connected to the computer network.

4. The method recited in claim 1, wherein the blocking address resolution replies contain a source physical device address corresponding to the physical device address of the client device, an is-at physical device address different than the physical device address of the client device, and a destination physical device address corresponding to a broadcast address.

5. The method recited in claim 2, wherein the is-at physical device address is a randomly changing physical device address pre-determined to not be connected to the computer network.

6. The method recited in claim 1, further comprising the steps of:

(g) if the blocking address replies are transmitting in accordance with step (f), transmitting an address resolution request on the computer network destined for the client device;

(h) if an address resolution reply is received in response to the transmitted address resolution request, determining whether the responsive address resolution reply contains a source physical device address corresponding to the physical device address of the client device;

(i) if the source physical device address of the responsive address resolution reply and the physical device address of the client device are the same as determined in step (h), repeating step (g);

(j) if the source physical device address of the responsive address resolution reply and the physical device address of the client device are different as determined in step (h), ceasing the transmission of the blocking address resolution replies.

7. The method recited in claim 1, further comprising the steps of:

(g) if access is allowed in accordance with step (e), transmitting an address resolution request on the computer network destined for the client device;

(h) if an address resolution reply is received in response to the transmitted address resolution request, determining whether the responsive address resolution reply contains a source physical device address corresponding to the physical device address of the client device;

(i) if the source physical device address of the responsive address resolution reply and the physical device address of the client device are the same as determined in step (h), repeating step (g);

(j) if the source physical device address of the responsive address resolution reply and the physical device address of the client device are different as determined in step (h), ceasing allowing the client device access to the protected devices.

8. The method recited in claim 1, further comprising the step of:

transmitting correction address resolution requests on the computer network to update the client device with the physical device address of the protected devices.

9. The method recited in claim 8, wherein the correction address resolution replies contain a is-at physical device address corresponding to the physical device address of one of the one or more protected devices and a destination physical device address corresponding to a broadcast address.

10. The method recited in claim 1, wherein no dedicated software is required on the client device.

11. The method recited in claim 1, wherein the blocking address resolution replies are configured to disable the client device.

12. An apparatus for blocking access to one or more protected devices each having a physical device address on a computer network by a client device having a physical device address, comprising the steps of:

means for receiving address resolution requests broadcast on the network by the client device seeking access to one of the protected devices;

means for processing the address resolution requests to determine whether the client device is an unknown device;

means for transmitting address resolution replies on the computer network to block access to the protected devices and allow access to an authentication server if the client device is unknown;

means for monitoring the authentication server to determine if the client device is authorized or unauthorized by the authentication server if the client device is unknown;

means for allowing access to the protected devices if the client device is authorized; and

means for transmitting blocking address resolution replies on the computer network to block access to the protected devices if the client device is unauthorized.

13. The apparatus recited in claim 12, wherein the restriction address resolution replies contain a source physical device address corresponding to the physical device address of the client device, an is-at physical device address different than the physical device address of the client device, and a destination physical device address corresponding to the physical device address of one of the protected devices.

14. The apparatus recited in claim 13, wherein the is-at physical device address is a randomly changing physical device address pre-determined to not be connected to the computer network.

15. The apparatus recited in claim 12, wherein the blocking address resolution replies contain a source physical device address corresponding to the physical device address of the client device, an is-at physical device address different than the physical device address of the client device, and a destination physical device address corresponding to a broadcast address.

16. The apparatus recited in claim 15, wherein the is-at physical device address is a randomly changing physical device address pre-determined to not be connected to the computer network.

17. The apparatus recited in claim 12, further comprising:

means for transmitting an address resolution request on the computer network destined for the client device if blocking address replies are transmitted;

means for receiving an address resolution reply in response to the transmitted address resolution request;

means for determining whether the responsive address resolution reply contains a source physical device address different than the physical device address of the client device; and

means for ceasing the transmission of the blocking address resolution replies if the source physical device address of the responsive address resolution reply is different than the physical device address of the client device.

18. The apparatus recited in claim 12, further comprising the steps of:

means for transmitting an address resolution request on the computer network destined for the client device if the client is allowed access to the protected devices;

means for transmitting an address resolution request on the computer network destined for the client device if blocking address replies are transmitted;

means for receiving an address resolution reply in response to the transmitted address resolution request;

means for determining whether the responsive address resolution reply contains a source physical device address corresponding to the physical device address of the client device; and

means for disallowing access to the protected devices by the client device if the source physical device address of the responsive address resolution reply is different than the physical device address of the client device.

19. The apparatus recited in claim 12, further comprising:

means for transmitting correction address resolution requests on the computer network to update the client device with the physical device address of the protected devices.

20. The apparatus recited in claim 19, wherein the correction address resolution replies contain a is-at physical device address corresponding to the physical device address of one of the one or more protected devices and a destination physical device address corresponding to a broadcast address.

21. The apparatus recited in claim 12, wherein the apparatus is connected as a peer device on the computer network.

22. The apparatus recited in claim 12, wherein no dedicated software is required in the client device.

23. The apparatus recited in claim 12, wherein the blocking address resolution replies are configured to disable the client device.

24. A method for blocking access to one or more protected devices each having a physical device address and being connected to a computer network by a client device having a physical device address and being connected to the computer network, comprising the steps of:

(a) receiving address resolution requests broadcast on the network by the client device seeking access to one of the protected devices;

(b) processing the address resolution requests to determine whether the client device is an unknown device;

(c) if the client device is unknown as determined in step (b), adding a record identifying the client device in a restricted client list;

(d) while the client device record is present in the restricted client list, transmitting address resolution replies on the computer network to block access to the protected devices and allow access to an authentication server, and monitoring the authentication server to determine if the client device is authorized or unauthorized by the authentication server;

(e) if the client device is authorized as determined in step (d), removing the client device record from the restricted client list and adding the client device record to an allowed client list;

(f) while the client device record is present in the allowed client list, allowing access to the protected devices;

(g) if the client device is unauthorized as determined in step (d), removing the client device record from the restricted client list and adding the client device record to a blocked client list; and

(h) while the client device record is present in the blocked client list, transmitting blocking address resolution replies on the computer network to block access to the protected devices.

25. The method recited in claim 24, further comprising the steps of:

(i) determining when the client device is no longer connected to the computer network; and

(j) when the client device is no longer connected to the computer network, removing the client device record from the allowed client list if the client device record is in the allowed client list and removing the client device record from the blocked client list if the client device record is in the blocked client list.