Security in area networks

• US 20040255033A1
• Filed: 12/03/2003
• Published: 12/16/2004
• Est. Priority Date: 06/07/2001
• Status: Abandoned Application

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Haverinen, Henry, Edney, Jonathan
• Application Number:
  US10/479,428
• Publication Number:
  US 20040255033A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 12/18 for broadcast or conference , e.g. multicast
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

The present invention provides an access point device arranged to receive data packets from one or more client devices and transmit them along an area network characterised wherein the access point device comprises security means arranged to configure the client data packets such that they are directed only to one or more permitted area network device(s).

Claims

1. An access point device arranged to receive data packets from one or more client devices and transmit them along an area network characterised wherein the access point device comprises security means arranged to configure the client data packets such that they are directed only to one or more permitted area network device(s).

2. The access point according to claim 1, wherein the security means is arranged to completely regenerate a data packet for transmission along the network and include a unique classifier of the permitted area network device into the regenerated data packet.

3. The access point according to claim 1, wherein the security means is arranged to substitute/insert a unique classifier of a permitted area network device, such as a permitted area network device MAC address or IP address, into the client data packet.

4. The access point device according to claim 1, wherein the security means is configured to consider the destination of the client data packet, and arranged to only configure the data packet if it is directed to a restricted network device.

5. The access point device according to claim 4, wherein the security means comprises a list of classifiers for permitted network devices and the security means is arranged to compare the destination of client data packets with the list, and re-configure the client data packet for onward transmission to a permitted device if the client data packet contains a classifier of a restricted network device.

6. The access point device according to claim 1, wherein the security means is arranged to also forward the original destination address, or addresses, of the data packet so that the data packet may be subsequently forwarded.

7. The access point device according to claim 1, wherein the security means is configured to differentiate between the different data packet forms and differentially modify the various data packet forms to be directed to a permitted network device.

8. The access point device according to claim 7, wherein the security means is arranged to differentiate between data packet transmission forms by comparison of client data packet data fields, or parts of data fields, with those of network permissible transmission forms recorded on the security means, and wherein the security means is further configured to make appropriate modifications to the client data packet to direct the transmission form to a permitted network device.

9. The access point device according to claim 8, wherein the security means is arranged to analyse the differing transmission forms and adapt each of these differing forms to provide data packets to the network with the same construction and overall data packet length.

10. The access point device according to claim 1, wherein the security means is arranged to modify the client data packet by the insertion of data fields into the data packet.

11. The access point device according to claim 10, wherein the security means is arranged to configure data packets using an industry standard protocol into a network specific protocol, and vice versa.

12. The access point device according to claim 7, wherein the security means is arranged to selectively modify certain data packets for onward transmission, and selectively exclude other data packets from network transmission.

13. The access point device according to claim 12, wherein the security means is configured to send a reply data packet back to the client device in response to a particular form of data packet transmission from the client device and/or in response to a data packet destined for a restricted network device.

14. The access point device according to claim 12, wherein the security means is configured to send, in response to identifying a particular transmission form, a reply data packet informing the client that the particular transmission form is not permitted, or is restricted, on the area network.

15. The access point device according to claim 7, wherein the security means is configured to seek permission form a client device as to whether the access point device is to forward a particular transmission form, and in the positive case, the access point device is configured to forward such transmissions.

16. The access point device according to claim 1, wherein the access point device is arranged to reply on behalf of a network device.

17. The access point device according to claim 16, wherein the network device is a restricted network device.

18. An access point device according to claim 1, wherein the access point device comprises security means arranged to provide mapping information of one or more permitted network devices to a client device in response to a client data packet concerning a restricted network device.

19. The access point device according to claim 18, wherein the security means is arranged to send an ARP transmission back to a client device in response to a data packet destined for a restricted network device.

20. The access point device according to claim 18, wherein the security means is arranged to send a proxy ARP Reply transmission back to a client device in response to an ARP request from the client device, said Proxy ARP Reply containing the link-layer address of one or more permitted network devices.

21. The access point device according to claim 20, wherein the link-layer address is the MAC address.

22. The access point device according to claim 1, wherein the security means is configured to accept a unicast ARP Reply from a client device in response to an authorised ARP Request.

23. The access point device according to claim 1, wherein the security means is configured to consider a characteristic of the data packet and based on the characteristic configure the data packet to be directed to a particular permitted area network device.

24. The access point device according to claim 1, wherein the security means is arranged to monitor the volume of transmissions sent to a particular permitted network device within a particular time and re-direct data packets to a different permitted network device according to the volume of transmissions sent to the particular permitted network device within the time.

25. The access point device according to claim 1, wherein the client data packet received by the access point device comprises protocol fields conforming to a standard protocol and wherein the security means is arranged to alter the content of one or more of the protocol fields to produce a modified client data packet which still conforms to a standard protocol.

26. The access point device according to claim 25, wherein the client data packet received by the access point device and modified client data packet conform to the same standard protocol.

27. The access point device according to claim 25, wherein the client data packet received by the access point device and modified client data packet conform to different standard protocols.

35. The access point device according to claim 1, wherein the security means is configured to accept a unicast ARP Reply from a client device in response to an authorised ARP Request.

36. An area network comprising the access point device as claimed in any of the preceding claims claim 1.

37. An public area network comprising the access point device as claimed in claim 1.

38. An access point device according to claim 1, wherein the area network is a public area network.

28. A method of providing security to an area network, comprising arranging to receive data packets from one or more client devices and transmitting them along an area network characterised wherein the client data packets are configured such that they are directed only to one or more permitted area network device(s).

29. An access point device arranged to receive data packets from one or more client devices and transmit them along an area network, characterised wherein the access point device is arranged to reply on behalf of a network device.

30. An access point device according to claim 29, wherein the network device is a restricted network device.

31. An access point device according to claim 30, wherein the access point device comprises security means arranged to provide mapping information of one or more permitted network devices to a client device in response to a client data packet concerning a restricted network device.

32. The access point device according to claim 31, wherein the security means is arranged to send an ARP transmission back to a client device in response to a data packet destined for a restricted network device.

33. An access point device according to claim 31, wherein the security means is arranged to send a proxy ARP Reply transmission back to a client device in response to an ARP request from the client device, said Proxy ARP Reply containing the link-layer address of one or more permitted network devices.

34. An access point device according to claim 33, wherein the link-layer address is the MAC address.

39. (Cancelled)

40. (Cancelled)

41. (Cancelled)