Access controller for local area network

• US 5,124,984 A
• Filed: 08/07/1990
• Issued: 06/23/1992
• Est. Priority Date: 08/07/1990
• Status: Expired due to Fees

• Current Assignee: Concord Communications Incorporated (Broadcom, Inc.)
• Original Assignee: Concord Communications Incorporated (Broadcom, Inc.)
• Inventors: Engel, Ferdinand
• Primary Examiner(s): Olms, Douglas W.
• Assistant Examiner(s): KIZOU, HASSAN
• Application Number:
  US07/564,026
• Time in Patent Office: 686 Days
• Field of Search: 370/85.1, 370/85.3, 370/92, 370/93, 370/94.1, 370/85.4, 370/85.5, 340/825.06, 340/825.31, 340/825.34, 379/35, 379/91, 379/95
• US Class Current: 370/230
• CPC Class Codes: H04L 12/22 Arrangements for preventing the taking of data from a data transmission channel without authorisation means for verifying the identity or the authority of a user of a secure or secret communication system H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

An access controller for peer-to-peer communication networks which monitors the data packets transmitted between stations, determines when an access that needs to be controlled is being made, and then either destroys the packet or transmits one or more packets which appear as legitimate message packets to the stations but which, in fact, terminates or alters the communication path between the two stations. Since the invention is free of any particular protocol restrictions, it can be implemented with any type of protocol and at any layer of that protocol. And since the access control mechanism is neither part of the physical communication path nor part of the communication primitives, the stations cannot detect, in any direct sense, that their access is being controlled, and they do not need to be programmed to follow any special control protocols, or to use encryption. A signature signal can be used as a safety mechanism to prevent multiple access controllers from controlling the same network, to prevent an unauthorized access controller from seizing control of the network.

Claims

1. An access controller for use in a communications network having a plurality of stations which vie for access to a shared physical medium, the access controller comprising:

means for passively detecting packets transmitted on the medium;

means for determining if a detected packet indicates that one of the stations is attempting an unauthorized access to another station; and

means for originating an access termination signal on the medium if the means for determining determines that the detected packet indicates an unauthorized access, the access termination signal selectively terminating the particular unauthorized access while allowing other authorized accesses by the attempting station to continue.

2. An access controller as in claim 1 wherein the means for determining additionally examines a source station identification field in the detected packet.

3. An access controller as in claim 1 wherein the means for determining additionally examines a destination station identification field in the detected packet.

4. An access controller as in claim 1 wherein the means for determining additionally examines a protocol type identification field in the detected packet.

5. An access controller as in claim 1 wherein the means for originating an access termination signal additionally transmits an access controller identification signal on the medium.

6. An access controller as in claim 5 wherein said network includes another access controller connected to the physical medium, said another access controller includes means for transmitting an access termination signal, and wherein said access controller additionally comprises:

means for shutting down the access controller for a predetermined period of time if an access controller identification signal transmitted by said another access controller is detected on the medium.

7. An access controller as in claim 6 wherein said access controller additionally comprises:

means for transmitting a shutdown signal on the medium before shutting down the access controller.

8. An access controller as in claim 7 wherein said another access controller includes means for transmitting a shutdown signal on the medium before before shutting down the access controller, and wherein said access controller additionally comprises:

means for shutting down the access controller for a predetermined period of time if a shutdown signal transmitted by said another access controller is detected on the medium.

9. An access controller as in claim 1 wherein the means for detecting packets detects data link layer packets.

10. An access controller as in claim 9 wherein the means for originating an access termination signal destroys the detected packet, if the means for determining determines that the detected packet indicates an unauthorized access.

11. An access controller as in claim 1 wherein the means for detecting packets detects network layer packets.

12. An access controller as in claim 11 wherein the means for originating an access termination signal transmits a connection termination packet to the station which was the source of the detected packet, the connection termination packet indicating that a destination station specified in the detected packet is not operable.

13. An access controller as in claim 1 wherein the means for detecting packets detects transport layer packets.

14. An access controller as in claim 13 wherein the means for originating an access termination sequence transmits a connection termination packet to both a destination station and a source station specified in the detected packet.

16. An access controller as in claim 1 wherein the network uses a carrier sense multiple access with collision detection (CSMA/CD) physical layer and the access termination signal is a signal that causes a collision with the detected packet.

17. An access controller as in claim 1 wherein the network uses a token ring physical layer.

18. An access controller as in claim 1 additionally comprising:

means for detecting a station address indicated by a destination field in the detected packet, and

wherein the access termination signal transmitted by the access controller is a packet having a source address field set equal to the destination field in the detected packet, and a field indicating that the station specified by the destination field in the detected packet is not able to receive packets.

19. An access controller as in claim 1 additionally comprising:

means for detecting a station address indicated by a source field in the detected packet, and

wherein the access termination signal transmitted by the access controller is a packet having a source address field set equal to the source field in the detected packet.

15. A network access controller comprising:

an interface circuit, connected to transmit and detect data packets on a physical medium shared by a plurality of network stations;

a memory, having stored therein data which represents a list of authorized network access types; and

processor means, connected to the interface circuit and the memory, for receiving a detected packet from the interface circuit, and for comparing the detected packet with the list of authorized network protocol types, to determine whether the detected packet indicates an unauthorized access, and, if the detected packet indicates an unauthorized access, for causing the interface circuit to transmit an access termination signal on the physical medium, the access termination signal selectively terminating the unauthorized access while allowing other authorized accesses to be attempted.

20. An access controller for use in a communications network having a plurality of stations which vie for access to a shared physical medium, the access controller comprising:

means for passively detecting packets transmitted on the medium;

means for determining if a detected packet indicates that one of the stations is attempting an unauthorized access to another station; and

means for transmitting an access termination signal to a source station which originated the detected packet, if the means for determining determines that the detected packet indicates an unauthorized access, and the access termination signal indicating to the source station that a destination station specified in the detected packet is not operable.

21. An access controller for use in a peer-to-peer communications network having a plurality of stations which vie for access to a shared physical medium, the access controller comprising:

means for passively detecting packets transmitted on the network;

means for determining if a detected packet indicates that a communication between a first station and a second station is being attempted, and that the attempted communication is of a type which is unauthorized; and

means for originating a termination signal which causes the unauthorized communication between the first and second station to terminate, while allowing the first and second stations to continue other authorized communications with each other, and allowing each of the first and second stations to continue other authorized communications with other stations.

22. A method for controlling access to a communications network in which a plurality of stations vie for access to a shared physical medium, the method comprising the steps of:

detecting packets transmitted on the medium;

determining if information in a detected packet indicates that one of the stations is attempting an unauthorized access to another station; and

if the detected packet indicates an unauthorized access, transmitting an access termination signal on the medium which selectively terminates the particular unauthorized access while allowing other authorized accesses by the attempting station to continue.

23. A method as in claim 22 wherein the step of determining if one of the stations is attempting an unauthorized access additionally comprises the step of:

examining a source station identification field in the detected packet.

24. A method as in claim 22 wherein the step of determining if one of the stations is attempting an unauthorized access additionally comprises the step of:

examining a destination station identification field in the detected packet.

25. A method as in claim 22 wherein the step of determining if one of the stations is attempting an unauthorized access additionally comprises the step of:

comparing a protocol type identification field in the detected packet to a list of authorized protocol types.

26. A method as in claim 22 wherein the step of transmitting an access termination signal additionally comprises:

transmitting an access controller identification signal on the medium.

27. A method as in claim 26 wherein the network includes another access controller which transmits identification signals on the physical medium, and the method additionally comprises the steps of:

waiting a predetermined period of time if an access controller identification signal transmitted by said another access controller is detected on the medium.

28. An access controller as in claim 27 additionally comprising the step of:

transmitting a shutdown signal on the medium before waiting a predetermined period of time.

29. A method as in claim 28 additionally comprising the step of:

waiting for a predetermined period of time if the step of detecting packets detects a shutdown signal transmitted on the medium by said another access controller.

30. A method as in claim 22 wherein the step of transmitting an access termination signal includes the step of destroying the detected packet.

31. A method as in claim 22 wherein the step of transmitting an access termination signal includes the step of transmitting a connection termination packet to the station which originated the unauthorized access.

32. A method as in claim 22 wherein the detected packet includes a source address field and a destination address field, and the step of transmitting an access termination signal includes the steps of

transmitting a connection termination packet to a station indicated by the source address field;

and

transmitting a connection termination packet to a station indicated by the destination address field.

33. A method as in claim 22 wherein the network uses a carrier sense multiple access with collision detection (CSMA/CD) physical layer and the step of transmitting an access termination signal includes the step of causing a collision with the detected packet.

34. A method as in claim 22 wherein the network uses a token ring data link layer .

35. A method as in claim 22 additionally comprising the steps of:

determining a station address indicated by a source field in the detected packet; and

wherein the step of transmitting an access termination signal includes the step of transmitting a packet having a destination address field set equal to the source field in the detected packet.

36. A method as in claim 22 additionally comprising the steps of:

determining a station address indicated by a destination field in the detected packet, and

wherein the step of transmitting an access termination signal includes the step of transmitting a packet having a source address field set equal to the destination field in the detected packet, and a field indicating that the attempted access should be terminated.

37. A method as in claim 22 additionally comprising the steps of:

determining a station address indicated by a source field in the detected packet, and

wherein the step of transmitting an access termination signal includes the step of transmitting a packet having a destination address field set equal to the source field in the detected packet, and a field indicating that the attempted access should be terminated.

38. A method for controlling access to a communications network having a plurality of stations which vie for access to a shared physical medium, the method comprising the steps of:

passively detecting packets transmitted on the medium;

determining if a detected packet indicates that one of the stations is attempting an access to another station which is unauthorized; and

if the detected packet indicates an unauthorized access, transmitting an access termination signal over the medium to a source station which originated the unauthorized access, the access termination signal indicating to the source station that a destination station specified in the detected packet is not operable.

39. A method for controlling access to a peer-to-peer communications network which includes a plurality of station that vie for access to a shared medium, the method comprising the steps of:

passively detecting packets transmitted on the shared medium;

determining if a detected packet indicates that a communication between a first station and a second station is being attempted, and that the attempted communication is of a type which is unauthorized; and

originating a termination signal on the medium which causes the unauthorized communication between the first and second station to terminate, while allowing the first and second stations to continue other authorized communications with each other, and allowing each of the first and second stations to continue other authorized communications with other stations.

40. A method for preventing unauthorized accesses to a communication medium shared by a plurality of network stations which communicate by exchanging data packets, the steps of the method performed by an access controller station which masquerades as one of the stations indicated as a destination address in an unauthorized access, the method comprising the steps of:

detecting information which indicates the type of data packet presently being communicated on the medium;

comparing the detected data protocol type to a list of authorized data protocol types, to determine if the protocol type presently being communicated on the medium is unauthorized; and

transmitting a reply packet on the medium, the reply packet appearing as a legitimate response by an intended destination station indicated by the detected packet, while terminating the unauthorized access and allowing other authorized accesses to continue.

41. A method for preventing a selected attempted communication by a first station with a second station within a network of stations connected by a physical medium, where the communication is being attempted in accordance with a packet-type communication protocol which provides a mechanism for effecting termination of the communication, said method comprising the steps of:

detecting the presence on the medium of a packet representing said selected attempted communication; and

preventing said selected attempted communication by said first station by originating on said physical medium an access prevention signal in accordance with said communication terminating mechanism, while allowing other communications by said first station to continue.