Method for preventing ethernet from being attacked

• US 20070274311A1
• Filed: 08/27/2004
• Published: 11/29/2007
• Est. Priority Date: 10/30/2003
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Yang, Lei
• Granted Patent: US 7,720,069 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 69/323 in the physical layer [OSI layer 1]

Abstract

A method for preventing Ethernet from being attacked is provided. The method comprises the steps as follows: after detecting a new connection between a port and a terminal device and receiving a data packet from the terminal device, an Ethernet communication device establishing and storing a fixed map between the port and a hardware address of the terminal device, then forwarding the data packet according to the fixed map; after detecting a disconnection between the port and the terminal device, the Ethernet communication device deleting the fixed map.

Claims

1. A method for preventing Ethernet from being attacked, comprising:

establishing and storing a fixed map between a port and a hardware address of a terminal device, then forwarding a data packet according to the fixed map after an Ethernet communication device detects a new connection between the port and the terminal device and receives a data packet from the terminal device; and

deleting the fixed map after the Ethernet communication device detects a disconnection between the port and the terminal device.

2. The method of claim 1, further comprising:

after receiving the data packet from the terminal device, judging whether the fixed map has been established;

if so, directly forwarding the data packet;

otherwise, establishing and storing the fixed map between the port and the hardware address of the terminal device.

3. The method of claim 2, wherein the step of directly forwarding the data packet comprises the step of judging whether the hardware address carried in the data packet is consistent with the hardware address corresponding to the port in said fixed map;

if so, forwarding the data packet according to a conventional forwarding processing;

otherwise, discarding the data packet.

4. The method of claim 3, further comprising:

after discarding the data packet, recording the judgment result in a log and informing a network administrator.

5. The method of claim 1, wherein said hardware address is a Media Access Control (MAC) address.

6. The method of claim 1, wherein detecting the new connection or the disconnection between the terminal device and the port is implemented by detecting physical signals in the port.

7. The method of claim 1, wherein said Ethernet communication device is a two-layer switch, a three-layer switch, a firewall device or an Ethernet bridge.

8. The method of claim 1, wherein said terminal device is a personal computer, a server or an IP telephone set.

9. The method of claim 1, wherein said fixed map is stored in a hardware address table of the Ethernet communication device.