METHODS AND APPARATUS TO ENHANCE SECURITY IN RESIDENTIAL NETWORKS

• US 20100162378A1
• Filed: 12/18/2008
• Published: 06/24/2010
• Est. Priority Date: 12/18/2008
• Status: Active Grant

• Current Assignee: SBC Knowledge Ventures LP
• Original Assignee: SBC Knowledge Ventures LP
• Inventors: Xu, Gang, Jayawardena, Thusitha, De Los Reyes, Gustavo
• Granted Patent: US 8,844,018 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

Example methods and apparatus to enhance security in residential networks and residential gateways are disclosed. A disclosed example apparatus includes a transceiver to receive an Internet protocol (IP) packet, a first packet processing module associated with a protected IP address, the first packet processing module to be communicatively coupled to a first network device, a second packet processing module associated with a public IP address, the second packet processing module to be communicatively coupled to a second network device, and a packet diverter to route the received IP packet to the first packet processing module when the IP packet contains the protected IP address and to route the IP packet to the second packet processing module when the IP packet does not contain the protected IP address.

Claims

1. An apparatus comprising:

a transceiver to receive an Internet protocol (IP) packet;

a first packet processing module associated with a protected IP address, the first packet processing module to be communicatively coupled to a first network device;

a second packet processing module associated with a public IP address, the second packet processing module to be communicatively coupled to a second network device; and

a packet diverter to route the received IP packet to the first packet processing module when the IP packet contains the protected IP address and to route the IP packet to the second packet processing module when the IP packet does not contain the protected IP address.

2. An apparatus as defined in claim 1, wherein the apparatus comprises a residential gateway.

3. An apparatus as defined in claim 1, wherein the transceiver comprises a customer-premises receiver.

5. An apparatus as defined in claim 1, further comprising:

a first packet processor to implement the first packet processing module and the packet diverter; and

a second packet processor to implement the second packet processing module.

7. An apparatus as defined in claim 1, wherein the protected IP address is associated with a protected service to be protected against Internet-originated attacks.

8. An apparatus as defined in claim 7, wherein the protected service is an IP television service.

9. An apparatus as defined in claim 1, wherein the packet diverter is to route the received IP packet to the second packet processing module when the IP packet contains a public IP address.

12. An apparatus as defined in claim 1, wherein the first packet processing module is associated with a first residential gateway and the second packet processing module is associated with a second residential gateway.

13. An apparatus as defined in claim 12, wherein the first and second residential gateways are located in a same enclosure.

14. An apparatus as defined in claim 1, wherein the first packet processing module, the second packet processing module and the packet diverter are located in a same enclosure.

15. An apparatus as defined in claim 1, wherein the packet diverter is to:

determine whether the IP packet originated at a trusted source; and

block the IP packet when the IP packet contains the protected IP address and does not originate at the trusted source.

16. An apparatus as defined in claim 1, wherein at least one of the first and second packet processing modules is to implement at least one of a network address translation module, a quality of service module, or a firewall module.

17. An apparatus as defined in claim 1, wherein the first packet processing module and the second packet processing module are located at a same customer premises.

18. An apparatus as defined in claim 1, further comprising a processor to execute:

a first virtual machine to implement the first packet processing module; and

a second virtual machine to implement the second packet processing module.

19. An apparatus as defined in claim 18, further comprising a third virtual machine to implement the packet diverter.

4. (canceled)

6. (canceled)

10. (canceled)

11. (canceled)

20. A method comprising:

receiving an Internet protocol (IP) packet;

determining whether the IP packet is addressed to a protected IP address;

determining whether the IP packet originated at a trusted source;

routing the IP packet to a first packet processing module when the IP packet is addressed to the protected IP address and originated from the trusted source; and

routing the IP packet to a second packet processing module when the IP packet is not addressed to the protected IP address.

23. A method as defined in claim 20, further comprising examining a field of the received IP packet to identify the destination IP address.

26. A method as defined in claim 20, further comprising blocking the IP packet when the IP packet does not originate from the trusted source and is addressed to the protected IP address.

21. (canceled)

22. (canceled)

24. (canceled)

25. (canceled)

27. An article of manufacture storing machine-accessible instructions that, when executed, cause a machine to:

receive an Internet protocol (IP) packet;

determine whether the IP packet is addressed to a protected IP address;

determine whether if the IP packet originated from a trusted source;

route the IP packet to a first packet processing module when the IP packet is addressed to the protected IP address and originated from the trusted source; and

route the IP packet to a second packet processing module when the IP packet is not addressed to the protected IP address.

28. An article of manufacture as defined in claim 27, where the machine-accessible instructions, when executed, cause the machine to route the IP packet to a set-top box when the IP packet is addressed to the protected IP address.

29-45. -45. (canceled)