Method for securing communication in a local area network switch

• US 20060013221A1
• Filed: 07/11/2005
• Published: 01/19/2006
• Est. Priority Date: 07/16/2004
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Alcatel SA (Nokia Corporation)
• Inventors: De Cnodder, Stefaan Jozef, Mensch, Patrick Paul Yvonne
• Granted Patent: US 7,593,397 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Method for securing communication in a local area network switch (AN) comprising a user interface (UI) and a network interface (NI), comprises the steps of extracting a source address (MACi) from each packet received by said Local area network switch (AN) and storing said address (MACi) together with associated information into a address forwarding table (FT) comprised in said Local area network switch (AN) is characterised in that a distinction is made between source addresses received from the user interface (UI) and the network interface (NI), such that upon detecting that a source address (MACi) contained within a newly received packet at the user interface (UI) was already stored as a source address received at the network interface (NI), said newly received packet will be discarded and its source address contained therein will not be stored within said address forwarding table (FT).

Claims

1. Method for securing communication in a local area network switch (AN) comprising a user interface (UI) and a network interface (NI), said method comprising the steps of extracting a source address (MACI) from each packet received by said Local area network switch (AN) and storing said address (MACI) together with associated information into a address forwarding table (FT) comprised in said Local area network switch (AN)

characterised in that

a distinction is made between source addresses received from the user interface (UI) and the network interface (NI), such that upon detecting that a source address (MACi) contained within a newly received packet at the user interface (UI) was already stored as a source address received at the network interface (NI), said newly received packet will be discarded and its source address contained therein will not be stored within said address forwarding table (FT).

2. Method according to claim 1, wherein further user information related to said discarded packet is stored within an additional table.

3. Method according to claim 2, wherein upon detecting that a new received network address was already stored as a user address in said address forwarding table (FT), the entry in the address forwarding table related to said user address will be stored in said additional table after which step said entry will be overwritten by the new received address and its associated information.

4. Local area network switch (AN) including a user interface (UI) and a network interface (NI) and an address forwarding table (FT) for storing a source addresses (MACi) extracted from each packet received by said local area network switch (AN) together with associated information related to said source addresses,

characterised in that

said local area network switch (AN) further includes discrimination means adapted to make a distinction between source addresses received from said user interface and said network interface, said local area network switch (AN) further includes comparison means for comparing a source address contained within a new arriving packet at said user interface (UI) with all stored source addresses in said forwarding table (FT) which were received from said network interface (NI), such as to provide a control signal to a discarding means for discarding said new arriving packet in case the source address contained therein was already stored as a source address received from said network interface.

5. Local area network switch (AN) according to claim 4 further including an additional table for storing further user information of the discarded packet.

6. Local area network switch (AN) according to claim 4 further including means for detecting that a new received network address was already stored as a user address in said address forwarding table (FT) and for sending the entry in the address forwarding table related to said user address to said additional table and to instruct said forwarding table to overwrite this entry by the new received address and its associated information.