System and method for preventing a first node from being emulated by another node

• US 6,151,679 A
• Filed: 01/21/1998
• Issued: 11/21/2000
• Est. Priority Date: 09/18/1995
• Status: Expired due to Fees

• Current Assignee: Broadband Capital Corporation (CommScope Holding Company, Inc.)
• Original Assignee: Fortress Technologies Incorporated (General Dynamics Corporation)
• Inventors: Friedman, Aharon, Levy, Ben Zion
• Primary Examiner(s): Laufer, Pinchus M.
• Application Number:
  US09/010,102
• Time in Patent Office: 1,035 Days
• Field of Search: 370/352, 370/389, 370/392, 370/401, 370/419, 379/90.01, 380/49, 380/21, 380/258, 380/283, 395/187.01, 713/151, 713/153, 713/154, 713/162, 713/164, 713/201, 709/229
• US Class Current: 726/3
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A network security device 10 is connected between a protected client 12 and a network 100. The network security device 10 negotiates a session key with any other protected client. Then, all communications between the two clients are encrypted. The inventive device is self-configuring and locks itself to the IP address of its client 12. Thus, the client 12 cannot change its IP address once set and therefore cannot emulate the IP address of another client. When a packet is transmitted from the protected host, the security device 10 translates the MAC address of the client to its own MAC address before transmitting the packet into the network. Packets addressed to the host, contain the MAC address of the security device. The security device 10 translates its MAC address to the client'"'"'s 12 MAC address before transmitting the packet to the client 12.

Claims

1. A network security device configured to receive communications from a node to be secured and pass the received communications to a network, and configured to be connected between the node to be secured and the network, the node to be secured having a first network address and the security device having the same network address as the node to be secured, the security device comprising:

(a) a permanent memory whose contents cannot be changed, and configured to store the first network address;

(b) a processor configured to;

(i) receive a communication from said node;

(ii) compare a network address in the received communication with the first network address stored in the permanent memory; and

(iii) not pass the communication to the network if the network address in the received communication is not the same as the first network address stored in the permanent memory.

2. The device of claim 1, wherein the node to be secured also has a first hardware address and the network security device has a second hardware address different from the first hardware address, the processor further configured to substitute in the received communication the first hardware address of the node to be secured with the second hardware address of the network security device.

3. The device of claim 1, wherein the security device cannot be logged into.

4. A network security device configured to be connected between a single node to be secured and a communications network, the security device comprising:

(a) a permanent memory configured to store a network address of the single node to be secured and the network address cannot be changed;

(b) a processor configured to;

(i) receive a communication from the single node to be secured;

(ii) compare a network address in the received communication with the network address of the single node to be secured stored in the permanent memory; and

(iii) not pass the communication to the network if the network address in the received communication is not the same as the network address stored in the permanent memory.

5. The device of claim 4, wherein the single node to be secured also has a first hardware address and the network security device has a second hardware address different from the first hardware address, the processor further configured to substitute in the received communication the first hardware address of the node to be secured with the second hardware address of the network security device.

6. A method performed by a security device having a permanent memory, the method preventing a first node in a communications network from being emulated by another node, the method comprising the steps of:

(a) storing an address of the first node in the memory of the security device in a manner that cannot be changed;

(b) when the security device receives a packet that is purportedly from the first node, comparing a source address in the packet with the address stored in the permanent memory; and

(c) if the source address in the communication is not the same as the address stored in the permanent memory, not passing the packet to the communications network.

7. The method of claim 6, wherein the step of storing comprises storing a network address.

8. The method of claim 6, wherein the step of storing comprises storing a hardware address.