METHOD AND APPARATUS FOR INTERNET PROTOCOL (IP) LOGICAL WIRE SECURITY

• US 20140192675A1
• Filed: 01/07/2013
• Published: 07/10/2014
• Est. Priority Date: 01/07/2013
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Perez, John Scott
• Granted Patent: US 9,094,331 B2
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/28 using route fault recovery

Abstract

A method and apparatus for improved approaches for detection of exploits and drift in a network is described. The method includes: determining, by a processor, a logical configuration of a network comprising a plurality of links connecting a plurality of nodes; determining, by the processor, a physical path corresponding to one of the links, the physical path including a plurality of switches of the network, wherein the processor is configured to determine whether data sent on one of the nodes to another one of the nodes by the one link is received at the other node; receiving an error detection value computed by one of the switches; and determining, by the processor, whether the error detection value corresponds with a value inaccessible to the one switch.

Claims

1. A method comprising:

determining, by a processor, a logical configuration of a network comprising a plurality of links connecting a plurality of nodes;

determining, by the processor, a physical path corresponding to one of the links, the physical path including a plurality of switches of the network, wherein the processor is configured to determine whether data sent on one of the nodes to another one of the nodes by the one link is received at the other node;

receiving an error detection value computed by one of the switches; and

determining, by the processor, whether the error detection value corresponds with a value inaccessible to the one switch.

2. The method according to claim 1, comprising:

receiving another error detection value computed by another one of the switches;

determining, by the processor, whether the other error detection value corresponds with another value, the value and the other value being inaccessible to the one switch and the other switch;

validating, by the processor, the one switch and the other switch when the error detection value and the other error detection value are identical to the value and the other value, respectively;

receiving a first and second geolocation from the one switch and the other switch switches, respectively; and

determining, by the processor, a physical path of network traffic forwarded by the one switch, other switch, or a combination thereof based on the received first and second geolocations when the one switch and the other switch are validated.

3. The method according to claim 2, comprising:

determining, by the processor, an indication of a physical location associated with the network traffic; and

comparing the indication of the physical location with the determined physical path.

4. The method according to claim 3, comprising:

determining a source and/or destination address of a datagram of the network traffic; and

determining the indication of the physical location according to the source and/or destination address.

5. The method according to claim 4, further comprising:

determining whether the first switch connects an end device associated with the destination or source address to the switches of the network; and

determining the indication of the physical location as the first geolocation based on whether the first switch connects the end device to the switches.

6. The method according to claim 3, wherein the indication of the physical location is an automatic number identification (ANI) of the network traffic.

7. The method according to claim 3, comprising:

determining a media access control (MAC) address of a endpoint device connected to the network via the first switch, the endpoint device being an endpoint of the network traffic;

determining a type of device according to the MAC address; and

determining the indication of the physical location based on the type of device.

8. The method according to claim 1, wherein the first error detection value is according to a configuration type and/or a datastore associated with the first switch, the value is stored in a datastore inaccessible to the processor and/or calculated by another processor, and the data is a datagram, the method further comprising initiating a stateful inspection of the network based on the comparison.

9. An apparatus comprising:

at least one processor; and

at least one memory including computer program code for one or more programs,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following,

determine a logical configuration of a network comprising a plurality of links connecting a plurality of nodes;

determine a physical path corresponding to one of the links, the physical path including a plurality of switches of the network, wherein the apparatus is configured to determine whether data sent on one of the nodes to another one of the nodes by the one link is received at the other node;

receive an error detection value computed by a first switch of the switches; and

compare the error detection value with a value inaccessible to the first switch.

10. The apparatus according to claim 9, wherein the apparatus is further caused to:

receive a second error detection value computed by a second switch of the switches;

compare, the second error detection value with a second value, the first and second values being inaccessible to the first and second switches;

validate the first and second switches when the first and second error detection values are identical to the first and second values, respectively;

receive a first and second geolocation from the first and second switches, respectively; and

determine a physical path of network traffic forwarded by the first switch, second switch, or a combination thereof based on the received first and second geolocations when the first and second switches are validated.

11. The apparatus according to claim 10, wherein the apparatus is further caused to:

determine, an indication of a physical location associated with the network traffic; and

compare the indication of the physical location with the determined physical path.

12. The apparatus according to claim 11, wherein the apparatus is further caused to:

determining a source and/or destination address of a datagram of the network traffic; and

determining the indication of the physical location according to the source and/or destination address.

13. The apparatus according to claim 12, wherein the apparatus is further caused to:

determining whether the first switch connects an end device associated with the destination or source address with the switches of the network; and

determining the indication of the physical location as the first geolocation based on whether the first switch connects the end device to the switches.

14. The apparatus according to claim 11, wherein the indication of the physical location is an automatic number identification (ANI) of the network traffic.

15. The apparatus according to claim 11, wherein the apparatus is further caused to:

determine a media access control (MAC) address of a endpoint device connected to the network via the first switch, the endpoint device being an endpoint of the network traffic;

determine a type of device according to the MAC address; and

determine the indication of the physical location based on the type of device.

16. The apparatus according to claim 9, wherein the first error detection value is according to a configuration type and/or a datastore associated with the first switch, the value is stored in a datastore inaccessible to the apparatus and/or calculated by another apparatus and the data is a datagram, the apparatus being further caused to initiate a stateful inspection of the network based on the comparison.

17. A method comprising:

receiving, at a switch, network traffic comprising datagrams;

determining, by the switch, a header of one of the datagrams, the header indicating a destination address;

selecting, by the switch, a physical link to transport the one datagram based on the destination address;

determining, by the switch, a network node to forward the one datagram based on the destination address;

forwarding, by the switch, the one datagram to the network node on the physical link;

computing, at the switch, an error detection value for the switch; and

forwarding the error detection value to a processing device to determine whether the error detection value corresponds to a value inaccessible to the switch.

18. The method according to claim 17, comprising:

computing the error detection value according to a configuration type of the switch and/or a datastore of the switch.

19. The method according to claim 17, further comprising:

determining the network node according to a routing table of the switch, wherein the error detection value is computed based on values indicated in the routing table.

20. An apparatus comprising:

at least one processor; and

at least one memory including computer program code for one or more programs,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following,

receive network traffic comprising datagrams;

determine a header of one of the datagrams, the header indicating a destination address;

select a physical link to transport the one datagram based on the destination address;

determine a network node to forward the one datagram based on the destination address;

forward the one datagram to the network node on the physical link;

compute an error detection value for the apparatus; and

forward the error detection value to a processing device to determine whether the error detection value corresponds to a value inaccessible to the apparatus.

21. The apparatus according to claim 20, wherein the apparatus is further caused to:

determine the error detection value according to a configuration type of the apparatus and/or a datastore of the apparatus.

22. The apparatus according to claim 20, wherein the apparatus is further caused to:

determine the network node according to a routing table of the apparatus, wherein the error detection value is computed based on values indicated in the routing table.