Back to results
US 11,310,190 B2Granted
Network anti-tampering system
AssigneeRidgeback Network Defense, Inc.
InventorThomas Sheppard Phillips
Life of this patent
Estimating the term…
Abstract
A system and method detects or prevents tampering of computer networks by transmitting address messages indicating that unused network addresses are in use. The systems and method handles requests for network resources, such as Address Resolution Protocol (ARP) messages, and provides fabricated information to a potential attacker to disrupt an attack on an information system.
Claims16
A system to detect and prevent network tampering comprising:
- an anti-tampering system,
- a network interface connecting the anti-tampering system to a network, and
- a software program running on the anti-tampering system, the software program containing instructions that, when executed by the anti-tampering system, cause the anti-tampering system to:
- monitor communications on the network during normal network communication;
- receive a plurality of Address Resolution Protocol (ARP) request messages from an information processing system connected to the network;
- determine whether each of the plurality of ARP request messages are for an Internet Protocol (IP) address that is in use on the network:
- identify ARP request messages directed to an IP address not in use on the network;
- for ARP request messages directed to an IP address that is in use on the network, determine whether the information processing system sending the ARP request messages is authorized to access the IP address;
- and
- transmit a plurality of ARP reply messages to the information processing system in response to ARP request messages identified as being directed to an IP address not in use on the system or to an IP address the information processing system is not authorized to access, wherein each reply messages comprises the IP address in the ARP request message being replied to and a Media Access Control (MAC) address that does not correspond to a network device using the IP address.
7 more elements
A method to detect and prevent network tampering over a network connected to an anti-tampering system through a network interface comprising:
- monitoring, with the anti-tampering system, communications on the network during normal network communication;
- receiving, with the anti-tampering system, an Address Resolution Protocol (ARP) request message from an information processing system connected to the network;
- determine whether the ARP request message is for an Internet Protocol (IP) address that is in use on the network or that is not in use on the network, and, if the message is directed to an IP address that is in use on the network, further determining whether the information processing system is authorized to access the IP address;
- transmitting, with the anti-tampering system, an ARP reply message to the information processing system in response to determining that the ARP request message is directed to an IP address not in use on the system or to an IP address the information processing system is not authorized to access, wherein the reply comprises the IP address in the ARP message request being replied to and a Media Access Control (MAC) address that does not correspond to a network device using the IP address.
1 more element
Dependencies are inferred from the claim text.