System and method for detecting and eliminating IP spoofing in a data transmission network

• US 7,380,272 B2
• Filed: 02/20/2002
• Issued: 05/27/2008
• Est. Priority Date: 05/17/2000
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: DeepNines Incorporated
• Inventors: Sharp, Clifford F., Dark, Susan Pittman
• Primary Examiner(s): JUNG, DAVID YIUK
• Application Number:
  US10/078,386
• Publication Number:
  US 20030110394A1
• Time in Patent Office: 2,288 Days
• Field of Search: 726/13, 726/27, 726/2, 726/3, 726/11, 726/14, 710/100, 709/235, 718/105, 711/170
• US Class Current: 726/11
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

A traffic management system sniffs data arriving at any point in a system. The sniffer operates to extract certain data from each address. This data could be, for example, the IP address data and the physical address data. The extracted data is then used to access different data bases to determine if matches occur. Time stamps, sequencing and other parameters of each piece of data entering a system are used to control data access.

Claims

1. The method of controlling a traffic management system, said method comprising the steps of:

reviewing certain parameters of data packets flowing into said system, said parameters pertaining to possible spoofing;

remembering for a period of time said reviewed certain parameters in conjunction with each received data packet; and

upon attainment of packet flow volume into said system reaching a certain level, temporarily storing certain subsequently received packets in accordance with selective remembered parameter of previously received packets.

2. The method of claim 1 wherein said certain level is user controlled.

3. The method of claim 1 wherein said certain level includes a plurality of levels, wherein the attainment of each successive level results in a more stringent application of said remembered certain parameters.

4. The method of claim 1 wherein said remembered parameters include one or more of:

a sender'"'"'s software address;

a sender'"'"'s hardware address;

a prior trouble causing address;

a notice of a potential trouble address;

amount of data transmitted from a particular address in a period of time;

number of packets arriving from a particular address in a period of time;

an address'"'"' domain name;

date of initial encounter with an address;

date of latest encounter with an address, a sequence number of a transaction;

a time stamp of a transaction.

5. The method of claim 4 wherein said certain level includes a plurality of levels arranged in a sequence, and wherein as the sequence of levels gets closer to an absolute maximum data flow rate more and more of said remembered parameters are included as a basis for said determination to temporarily store a particular packet.

6. The method of claim 5 further including the step of:

arbitrarily selecting packets for temporary storing when said data flow rate reaches its maximum capacity.

7. The method of claim 1 further including the step of:

retrieving said temporarily stored data packets when traffic flow into said system falls below said certain level.

8. The method of claim 7 further including the step of:

putting at least some of said retrieved data packets through said system.

9. The method of claim 1 further comprising the step of:

dynamically displaying information pertaining to temporarily stored ones of said data packets.

10. The method of claim 9 wherein said displaying step includes:

transmitting said display information to a remote location.