System and apparatus for rogue VoIP phone detection and managing VoIP phone mobility

• US 20070067823A1
• Filed: 09/02/2005
• Published: 03/22/2007
• Est. Priority Date: 09/02/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Byun, Joonbum, Shim, Choon
• Granted Patent: US 8,238,352 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 61/4535 using an address exchange platform which sets up a session between two nodes, e.g. rendezvous servers, session initiation protocols [SIP] registrars or H.323 gatekeepers
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A method and a system track network access information for authorized network devices. The access information facilitates tracking movement of the device throughout the network. In addition the access information can be used to detect when an unauthorized device attempts to access the network, posing as an authorized device.

Claims

1. A method for detecting presence of an unauthorized device on a communications network, comprising:

compiling address and switch port data for a plurality of devices authorized to access a communications network;

detecting an attempted call on the communications network;

detecting an address and switch port data for the device initiating the attempted call;

comparing said detected address and switch port data to said compiled address and switch port data;

detecting a match of said detected address and one of the compiled addresses;

determining that said detected switch port data for the detected address does not match the port data for the compiled address that matches said detected address; and

identifying said device having the detected address as an unauthorized device.

2. The method of claim 1 wherein compiling address and switch port data includes building a database including access history for a plurality of authorized devices wherein said database associates a device address with a switch and a connection status.

3. The method of claim 1 wherein compiling said address and switch port data including creating an access control list including device address, device switch data and device location data.

4. The method of claim 1 where said device is an IP phone and said address data include a MAC address and an IP address.

5. A method for blocking a rogue IP phone from access to an IP communications network, comprising:

detecting an address of an IP phone;

comparing said detected address to a list of authorized IP phones to find an IP phone having an address matching said detected address;

comparing switch data associated with said IP phone to switch data associated with the IP phone having the matching address;

determining said IP phone to be a rogue IP phone based on said comparison of switch data; and

tearing down a communication connection from said rogue phone.

6. A method for tracking movement of an IP telephone in a communications network, comprising:

detecting a connection of an IP phone to a port of a switch within a network;

determining an address of the detected IP phone;

determining, with reference to an access list and the determined address, that the detected phone has previously been connected to and then disconnected from another port within the network;

identifying the detected phone as a moved phone; and

updating the access list to reflect information about the detected phone including current port connection information.

7. The method of claim 6 wherein said updated access list includes data concerning the IP phone sufficient to identify a geographic location of the IP phone.