SYSTEM AND METHOD FOR DETECTING AND INTERCEPTION OF IP SHARER

• US 20080008171A1
• Filed: 06/28/2007
• Published: 01/10/2008
• Est. Priority Date: 12/28/2004
• Status: Abandoned Application

• Current Assignee: KT Corporation
• Original Assignee: KT Corporation
• Inventors: KIM, JAE-DONG, KIM, EUN-HO, CHOI, YOUNG-SOO, BAE, BYEONG-SOOK
• Application Number:
  US11/770,417
• Publication Number:
  US 20080008171A1
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/5046 Resolving address allocation conflicts; Testing of addresses testing when self-assigning an address H04L61/5092
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Disclosed is an IP sharer detecting and intercepting system and method. According to the IP sharer detecting and intercepting method, all the IP packets transmitted through the network are detected, an ID value of the IP header is extracted from the detected IP packets, and an IP sharer user is estimated based on the number of states of ID values for the same IP. A notice packet is transmitted to the estimated IP sharer user to detect a private IP of the IP sharer user, it is determined whether the IP sharer user uses the IP sharer based on the detected private IP, and the checked IP sharer user'"'"'s Internet connection is intercepted. In this instance, a notice packet for introducing an entrance to a normal cable is generated to the IP sharer user before the checked IP sharer user'"'"'s Internet connection is intercepted.

Claims

1. A system for monitoring an IP sharer for providing Internet services to a plurality of PCs by using a certified IP address, comprising:

a sharer database for storing information on an estimated IP sharer user, the information including an IP address allocated to the IP sharer of the estimated IP sharer user;

a packet detector for detecting all IP packets transmitted from a subscriber PC to a network;

an ID analyzer for extracting an ID value from an ID header of the IP packet transmitted from the packet detector, detecting an ID value flow generated for the same IP address, and when a flow of a plurality of ID values is generated for the same IP address, estimating the corresponding IP address to be an IP address of the IP sharer user, and storing estimated IP sharer user information in the sharer database;

a notice transmitter for generating a notice packet for detecting an IP address established in the PC of the estimated IP sharer user, and transmitting the generated notice packet to the PC of the estimated IP sharer user;

a private IP address detector for detecting an IP address established in the PC when the transmitted notice packet is output to the PC; and

a subscriber interceptor for checking whether the estimated IP sharer user uses the IP sharer based on the detected IP address.

2. The system of claim 1, wherein the subscriber interceptor intercepts the estimated IP sharer user'"'"'s Internet use according to the checking result on the IP sharer use.

3. The system of claim 2, wherein the packet detector transmits the detected IP packets to the ID analyzer, transmits a first packet that is a TCP packet from among the detected IP packets to the subscriber interceptor, and transmits a second packet that is a TCP packet having a destination port as a specific port number from among the detected IP packets to the notice transmitter.

4. The system of claim 2, wherein a packet for introducing a subscription through a normal line is generated and is transmitted to the PC by the notice transmitter before the Internet use is intercepted.

5. The system of claim 1, wherein the packet detector transmits the detected IP packets to the ID analyzer, transmits a first packet that is a TCP packet from among the detected IP packets to the subscriber interceptor, and transmits a second packet that is a TCP packet having a destination port as a specific port number from among the detected IP packets to the notice transmitter.

6. The system of claim 5, wherein the notice transmitter determines whether the TCP packet is an Internet connection setting request packet including a specific destination port number, and generates a notice packet corresponding to the determined Internet connection setting request packet when the IP address of the second packet corresponds to the IP address allocated to the IP sharer.

7. The system of claim 5, wherein the subscriber interceptor checks specific bit information of the first packet to detect the Internet connection setting request packet, generates an Internet interception packet corresponding to the detected Internet connection setting request packet, and transmits the Internet interception packet to the PC, the bit information including ACK (Acknowledgment field significant), PSH (Push function), and SYN (Synchronize sequence number).

8. A method for monitoring an IP sharer for providing Internet services to a plurality of PCs by using a certified IP address, comprising:

a) detecting IP packets transmitted from a subscriber PC to a network;

b) extracting an ID value of an IP header from the detected IP packet, detecting an ID value flow generated for the same IP address, and when a flow of a plurality of ID values is generated for the same IP address, estimating the corresponding IP address as an IP address of the IP sharer user, and storing user information including an IP address allocated to the IP sharer of the estimated IP sharer user;

c) transmitting a notice packet for detecting the IP address established to the PC of the estimated IP sharer user, and detecting a private IP established to the PC when the transmitted notice packet is output to the PC; and

d) checking whether the estimated IP sharer user uses the IP sharer based on the detected private IP address.

9. The method of claim 8, further comprising, after d), intercepting the checked IP sharer user'"'"'s Internet connection according to the checking result.

10. The method of claim 9, further comprising, after d), generating and transmitting a packet for introducing a subscription through a normal line before the Internet use is intercepted.

11. The method of claim 9, wherein c) comprises:

generating a notice packet corresponding to an Internet connection setting request packet having a specific destination port number from among the IP packets detected in a);

transmitting the generated notice packet according to a predetermined notice transmission rule; and

starting an operation and detecting a private IP address when the transmitted notice packet is output on a web browser of the PC.

12. The method of claim 9, wherein e) comprises:

e-1) checking a code bit of the TCP packet included by the IP packet detected in a), and extracting an Internet connection setting request packet, the code bit being ACK (Acknowledgment field significant), PSH (Push function), and SYN (Synchronize sequence number) included in the TCP packet;

e-2) generating an Internet interception packet for intercepting the Internet connection in correspondence to the extracted Internet connection setting request packet; and

e-3) transmitting the generated Internet interception packet to the checked IP sharer user, and intercepting the Internet.

13. The method of claim 12, wherein e-1) comprises checking the ACK or the PSH of the code bit when the port number of the TCP packet is given to be 80, and checking the SYN of the code bit when the port number is not 80.

14. The method of claim 8, wherein c) comprises:

generating a notice packet corresponding to an Internet connection setting request packet having a specific destination port number from among the IP packets detected in a);

transmitting the generated notice packet according to a predetermined notice transmission rule; and

starting an operation and detecting a private IP address when the transmitted notice packet is output on a web browser of the PC.