NETWORK INTRUSION MITIGATION

• US 20170149806A1
• Filed: 11/25/2015
• Published: 05/25/2017
• Est. Priority Date: 11/25/2015
• Status: Active Grant

• Current Assignee: EchoStar Technologies International Corporation (Echostar Corporation)
• Original Assignee: Echostar Technologies LLC (Echostar Corporation)
• Inventors: Beals, William Michael
• Granted Patent: US 10,187,402 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A request is received to reestablish a connection to an end device in a network. At least one datum is identified indicating an error condition, the at least one datum including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet. Based on the one or more data values, user input is requested to deny the reestablish connection request. In response to the user input, the end device is prevented from reestablishing a link on the network

Claims

1. A device that includes a processor and a memory, the memory storing instructions executable by the processor such that the device is programmed to:

receive a request to reestablish a connection to an end device in a network;

identify at least one datum indicating an error condition, the at least one datum including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet; and

based on the one or more data values, requesting user input to deny the reestablish connection request; and

in response to the user input, prevent the end device from reestablishing a link on the network.

2. The device of claim 1, wherein the network is a mesh network.

3. The device of claim 1, wherein the device is further programmed to:

reestablish the communication between the device and the end device, based upon the reestablish response.

4. The device of claim 1, wherein the device is further programmed to:

identify the BER by determining that a packet error rate for the communications from the end device exceed a predetermined threshold.

5. The device of claim 4, wherein the device is further programmed to:

start a BER timer; and

determine when the BER timer exceeds a predetermined BER timer threshold.

6. The device of claim 1, wherein the device is further programmed to determine the RSSI value exceeds a predetermined threshold.

7. The device of claim 6, wherein the device is further programmed to:

start a RSSI timer; and

determine when the RSSI timer exceeds a predetermined RSSI timer threshold.

8. The device of claim 1, wherein the device is further programmed to:

identify the foreign packet by comparing an address of the foreign packet to a known address.

9. The device of claim 8, wherein the device is further programmed to:

start a foreign packet counter; and

determine when the foreign packet counter exceeds a predetermined foreign packet counter threshold.

10. The device of claim 1, wherein the device is a ZigBee coordinator.

11. A method comprising:

receiving a request to reestablish a connection to an end device in a network;

identifying at least one datum indicating an error condition, the at least one datum including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet; and

based on the one or more data values, requesting user input to deny the reestablish connection request; and

in response to the user input, preventing the end device from reestablishing a link on the network.

12. The method of claim 11, wherein the network is a mesh network.

13. The method of claim 11, further comprising reestablishing the communication between the device and the end device, based upon the reestablish response.

14. The method of claim 11, further comprising:

identify the BER by determining that a packet error rate for the communications from the end device exceed a predetermined threshold.

15. The method of claim 14, further comprising:

starting a BER timer; and

determining when the BER timer exceeds a predetermined BER timer threshold.

16. The method of claim 11, further comprising determining the RSSI value exceeds a predetermined threshold.

17. The method of claim 11, further comprising:

starting a RSSI timer; and

determining when the RSSI timer exceeds a predetermined RSSI timer threshold.

18. The method of claim 11, further comprising:

identifying the foreign packet by comparing an address of the foreign packet to a known address.

19. The method of claim 11, further comprising:

starting a foreign packet counter; and

determining when the foreign packet counter exceeds a predetermined foreign packet counter threshold.

20. A system, comprising a computer having a processor and a memory, the memory storing instructions executable by the processor such that the computer is programmed to:

receive a request to reestablish a connection request to an end device in a network;

identify one or more data values from the end device, the data values including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value and a foreign packet in a communication; and

based on the one or more data values, requesting user input to deny the reestablish connection request; and

in response to the user input, prevent the end device from reestablishing a link on the network.