System and method for detecting added network connections including wiretaps

• US 20060164998A1
• Filed: 01/26/2005
• Published: 07/27/2006
• Est. Priority Date: 01/26/2005
• Status: Abandoned Application

• Current Assignee: Avago Technologies General IP PTE Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Pharn, Art
• Application Number:
  US11/042,179
• Publication Number:
  US 20060164998A1
• Time in Patent Office: Days
• US Class Current: 370/241
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A TDR (Time Domain Reflectometry) circuit associated with a computer network device monitors a network connection to identify changes in that connection. The disclosed system and method may provide notification when a possible attempt to intercept signals in the network has been detected, and may be automatically controlled to perform periodic monitoring of the network.

Claims

1. A monitoring method, comprising the steps of:

providing a network interface device with an integral time domain reflectometry circuit and connecting said network interface device to a network cable;

transmitting a signal into said network cable;

detecting a reflection of said signal using said time domain reflectometry circuit; and

activating an indication if said reflection indicates that said network cable has been tapped.

2. The method of claim 1, wherein said network interface device is one of a hub, a router, a switch, and a transceiver.

3. The method of claim 1, wherein said network interface device is an Ethernet interface device.

4. The method of claim 1, comprising the further steps of:

storing reflection signature data defining a first TDR state of the network cable; and

determining whether said network cable has been tapped based on a comparison of said reflection signature data and said reflection of said signal.

5. The method of claim 1, comprising the further step of periodically repeating said transmitting, detecting, and activating steps.

6. The method of claim 5, comprising the further step of providing an automated timer to control said repeating of said transmitting, detecting, and activating steps.

7. The method of claim 5, wherein said signal periodically transmitted into said network cable is a network link pulse.

8. The method of claim 1, comprising the further step of applying security measures to a portion of the network where a possible tap has been detected.

9. The method of claim 8, wherein said security measures comprise at least partially blocking communications between the network and a tapping device.

10. A network monitoring apparatus, comprising:

a network interface device with an integral time domain reflectometry circuit;

transmitting means for transmitting a signal into a network cable;

processing means for detecting a reflection of said signal and determining whether said network cable has been tapped; and

indicating means for providing an indication when said processing means determines that said network cable has been tapped.

11. The apparatus of claim 10, wherein said network interface device is one of a hub, a router, a switch, and a transceiver.

12. The apparatus of claim 10, wherein said network interface device is an Ethernet interface device.

13. The apparatus of claim 10, further comprising:

storage means for storing reflection signature data defining a first TDR state of the network cable; and

comparison means associated with said processing means for determining whether said network cable has been tapped based on a comparison of said reflection signature data and said reflection of said signal.

14. The apparatus of claim 10, further comprising timing means for periodically actuating said transmitting means and processing means to conduct a TDR test.

15. The apparatus of claim 14, wherein said transmitting means periodically transmits a link pulse signal into the network cable.

16. The apparatus of claim 10, further comprising security means for applying security measures to a portion of the network where a possible tap has been detected.

17. The apparatus of claim 16, wherein said security measures comprise at least partially blocking communications between the network and a tapping device.

18. A monitoring method, comprising the steps of:

connecting a time domain reflectometry circuit to a network cable during data transmission operations;

repeatedly transmitting a signal into said network cable, and

automatically controlling operation of said time domain reflectometry circuit to detect a reflection of said signal using said time domain reflectometry circuit, and activate an indication if said reflection indicates that said network cable has been tapped.

19. The method of claim 18, wherein said time domain reflectometry circuit is integrated with one of a hub, a router, a switch, and a transceiver.

20. The method of claim 19, wherein said time domain reflectometry circuit is integrated with an Ethernet device.

21. The method of claim 19, comprising the further steps of:

storing reflection signature data defining a first TDR state of the network cable; and

determining whether said network cable has been tapped based on a comparison of said reflection signature data and said reflection of said signal.

22. The method of claim 18, comprising the further step of at least partially blocking further communications between the network and a tapping device in a portion of the network where a possible tap has been detected.