System and method for detecting and eliminating IP spoofing in a data transmission network

• US 7,865,945 B2
• Filed: 05/23/2008
• Issued: 01/04/2011
• Est. Priority Date: 05/17/2000
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Dark, Susan P., Sharp, Clifford F.
• Primary Examiner(s): Jung; David Y
• Application Number:
  US12/126,729
• Publication Number:
  US 20090288156A1
• Time in Patent Office: 956 Days
• Field of Search: 726/11, 726/3, 726/2
• US Class Current: 726/11
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

A traffic management system sniffs data arriving at any point in a system. The sniffer operates to extract certain data from each address. This data could be, for example, the IP address data and the physical address data. The extracted data is then used to access different data bases to determine if matches occur. Time stamps, sequencing and other parameters of each piece of data entering a system are used to control data access.

Claims

1. A traffic management system for use in conjunction with packet data, said system operative for passing data packets there through, said system comprising:

means for extracting certain parameters of data from each packet of data which is flowing into said system; and

means for comparing said extracted data against at least one database to determine if the data packet associated with said extracted data is valid.

2. The traffic management system of claim 1 wherein said extracted data includes the software and hardware address of the originator of said packet.

3. The traffic management system of claim 2 wherein a network database is queried for each packet based upon the extracted address information of said packet.

4. The traffic management system of claim 2 further including:

a local database wherein extracted ones of said hardware and software addresses are stored.

5. The traffic management system of claim 4 wherein said comparing means compares the extracted hardware and software address pairs from each packet against said stored address into data in said local database.

6. The traffic management system of claim 1 wherein said extracting means extracts sequencing data and/or time stamp data for said packets.

7. The traffic management system of claim 5 further including:

a local database wherein extracted ones of said sequencing and/or time stamp data is stored.

8. The traffic management system of claim 7 wherein said comparing means compares the extracted sequences and/or time stamp data from each packet against said stored sequence and/or time stamped data in said local database.