Tracking multiple interface connections by mobile stations

• US 7,236,470 B1
• Filed: 09/15/2003
• Issued: 06/26/2007
• Est. Priority Date: 01/11/2002
• Status: Expired due to Term

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Bims, Harry
• Primary Examiner(s): Pezzlo; John
• Assistant Examiner(s): MEHRA, INDER P
• Application Number:
  US10/663,167
• Time in Patent Office: 1,380 Days
• Field of Search: 370/351, 370/328, 725/119, 455/436, 455/426.1, 455/426.2, 455/552.1
• US Class Current: 370/328
• CPC Class Codes: H04B 17/318 Received signal strength
• CPC Class Codes: H04B 7/022 Site diversity; Macro-diversity using two or more spaced independent antennas H04B7/04
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 69/324 in the data link layer [OSI layer 2], e.g. HDLC
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method and apparatus for communicating between devices is described. In one embodiment, the method comprises allowing a mobile station to have a first connection to a network over a first interface and determining that the mobile station is attempting to have a second connection to the network over a second interface other than the first interface.

Claims

1. A method comprising:

allowing a station to have a first connection to a network over a first interface; and

determining that the station is attempting to have a second connection to the network over a second interface other than the first interface by checking whether media access control (MAC) addresses of the first and second interfaces belong to the station.

2. The method defined in claim 1 further comprising enforcing a security policy if the station is attempting to connect to the network over the second interface.

3. The method defined in claim 2 wherein the security policy does not permit connection to the network through multiple interfaces of the same station, and wherein enforcing the security policy comprises denying the second connection to the network.

4. The method defined in claim 3 wherein denying the second connection comprises disabling a MAC address associated with the second interface.

5. The method defined in claim 2 wherein the security policy does not permit connection to the network through multiple interfaces of the same station, and wherein enforcing the security policy comprises disabling the first connection to the network.

6. The method defined in claim 5 wherein disabling the first connection comprises removing a MAC address associated with the first interface from a list of active stations.

7. The method defined in claim 2 wherein the security policy does not permit connection to the network through multiple interfaces of the same station, and wherein enforcing the security policy comprises denying the first and second connections to the network.

8. The method defined in claim 7 wherein denying the first connection comprises removing a MAC address associated with the first interface from a list of active stations and disabling its corresponding entry in the access control list, and further wherein denying the second connection comprises disabling a second MAC address associated with the second interface from becoming listed in a list of active stations.

9. The method defined in claim 2 wherein the security policy allows access to the network by the station over multiple interfaces.

10. A method comprising:

reconciling a plurality of interfaces corresponding to a single station when the station has access to a network resource through a first of the plurality of interfaces and is attempting to gain access to the network resource through a second of the plurality of interfaces; and

enforcing a security policy with respect to the single station in response to the single station attempting to have a plurality of interfaces by which to access the network resource by checking whether media access control (MAC) addresses of the first and second interfaces belong to the station.

11. A switch for providing access to a network for one or more stations, the switch comprising:

a plurality of ports;

a controller coupled to the ports to allow a station to have a first connection to a network over a first interface and to determine that the station is attempting to have a second connection to the network over a second interface other than the first interface by checking whether media access control (MAC) addresses of the first and second interfaces belong to the station.

12. The switch defined in claim 11 wherein the controller enforces a security policy in response to determining that the station is attempting to connect to the network over a second interface other than the first interface.

13. The switch defined in claim 12 wherein the security policy does not permit connection to the network through multiple interfaces of the same station, and wherein the controller enforces the security policy by denying the second connection to the network.

14. The switch defined in claim 13 wherein denying the second connection comprises disabling a MAC address associated with the second interface.

15. The switch defined in claim 12 wherein the security policy does not permit connection to the network through multiple interfaces of the same station, and wherein the controller enforces the security policy by disabling the first connection to the network.

16. The switch defined in claim 15 wherein the controller denies the first connection by removing a MAC address associated with the first interface from a list of active stations.

17. The switch defined in claim 12 wherein the security policy does not permit connection to the network through multiple interfaces of the same station, and wherein the controller enforces the security policy by disabling the first and denying the second connections to the network.

18. The switch defined in claim 11 wherein the controller disables the first connection by removing a MAC address associated with the first interface from a list of active stations and denies the second connection by disabling a second MAC address associated with the second interface from becoming listed in a list of active stations.

19. A method comprising:

allowing a station to have a set of one or more connections to a network over a first set of one or more interfaces;

determining that the station is attempting to have another connection to the network over another interface other than the first set of interfaces interface by checking whether media access control (MAC) addresses of the first and second interfaces belong to the station; and

performing an action in response to determining the station is attempting the other connection.