Methods and devices for detecting an IP address

• US 8,978,099 B2
• Filed: 01/29/2012
• Issued: 03/10/2015
• Est. Priority Date: 01/28/2011
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: H3C Technologies Co., Limited (Hewlett-Packard Enterprise Company)
• Inventors: Li, Wei
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US13/997,079
• Publication Number:
  US 20130298207A1
• Time in Patent Office: 1,136 Days
• Field of Search: 726 2- 6, 726 11- 14, 726 27- 29, 713153-154, 709224-225
• US Class Current: 726/2
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A method for detecting an IP address. An access router releases the routes of a detected IP address via a first interface and a second interface, and sets the priority of the route released via said first interface lower than that of the route released via said second interface. After having received by said access router a WEB request by the user via said first interface, the method comprises searching a session record corresponding to said WEB request; establishing by said access router the session record corresponding to said WEB request when the corresponding session record is not found, and returning a redirecting message taking said detected IP address as the re-directed destination IP address; and after having received by said access router via said second interface the message taking said detected IP address as the destination IP address, determining that the user who sent said message is an illegal user.

Claims

1. A method for detecting an IP address, for application in an access router in an operator'"'"'s network, with said access router being connected via a first interface to a network accessed by a user and being connected via a second interface to an upstream access channel of the operator'"'"'s network, wherein, said access router configures the detected IP address and the method comprises:

releasing by said access router routes of said detected IP address via said first interface and said second interface, and setting that a priority of the route released via said first interface is lower than that of a route released via said second interface;

after having received by said access router a WEB request by the user via said first interface, searching a session record corresponding to said WEB request;

establishing by said access router the session record corresponding to said WEB request when the corresponding session record is not found, and returning a redirecting message taking said detected IP address as a re-directed destination IP address; and

after having received by said access router via said second interface another message having the re-directed destination IP address, determining that the user who sent said another message is an illegal user.

2. The method as claimed in claim 1, wherein said access router configuring the detected IP address comprises:

configuring by said access router said detected IP address on a loopback interface.

3. The method as claimed in claim 1, wherein said setting that the priority of the route released via said first interface is lower than that of the route released via said second interface comprises:

increasing the path length of an autonomous system path (AS-Path) or modifying the value of a multi-exit discriminator (MED) when the route via said first interface is released.

4. The method as claimed in claim 1, wherein said redirecting message further carries a feature identification of the session record corresponding to said WEB request, and

after having determined that the user who sent said message is an illegal user, the method further comprises:

searching the corresponding session record according to the feature identification of the session record carried by said redirecting message and deleting the same.

5. The method as claimed in claim 1, wherein said access router determines that the user who sent said another message is a legal user when the corresponding session record is found or when said access router receives via said first interface a message taking said detected IP address as the destination IP address.

6. A device for detecting an IP address, which device acts as an access router for application in an operator'"'"'s network, wherein said device is connectable via a first interface to a network accessed by a user and is connectable via a second interface to an upstream access channel of the operator'"'"'s network, said device comprises:

a configuration unit to configure a detected IP address;

a route releasing unit to release routes of said detected IP address via said first interface and said second interface, and to set that the priority of the route released via said first interface is lower than that of the route released via said second interface;

a receiving unit to receive messages sent by the user via said first interface and second interface;

a searching unit to search a session record corresponding to a WEB request when said receiving unit receives via said first interface said WEB request sent by the user;

a record establishing unit to establish a session record corresponding to said user when said searching unit fails to find a matched session record;

a redirecting unit to return a redirecting message which takes said detected IP address as a re-directed destination IP address when said searching unit fails to find the corresponding session record; and

a detecting unit to detect whether a destination IP address of another message received by said receiving unit via said second interface is said detected IP address, and determining that the user who sent said another message is an illegal user when the detection result is yes.

7. The device as claimed in claim 6, wherein said configuration unit is to configure said detected IP address on a loopback interface.

8. The device as claimed in claim 6, wherein said route releasing unit is to increase the path length of an autonomous system path (AS-Path) or modifying the value of a multi-exit discriminator (MED) when the route is released via said first interface.

9. The device as claimed in claim 6, wherein said redirecting message further carries a feature identification of the session record corresponding to said WEB request, and the device further comprises:

a deleting unit to search the corresponding session record according to the feature identification of the session record carried by said redirecting message when said detecting unit determines that the user who sent said another message is an illegal user, and to delete the same.

10. The device as claimed in claim 6, wherein said detecting unit is further to:

determine that the user who sent said another message is a legal user when the corresponding session record is found by said searching unit or when said receiving unit receives via said first interface a message which takes said detected IP address as the destination IP address.