Back to results
US 12,750,339 B2Granted
Intra-LAN network device isolation
AssigneeAvast Software s.r.o.
InventorsWicher Thomas Maarseveen, Jiří Suška
Life of this patent
Estimating the term…
Abstract
A private network device such as a security device is inserted in a local network and is operable to isolate networked devices on the local network. The networked security device uses Internet Protocol spoofing to intercept network traffic between at least two networked devices on the same local network as the networked security device, and selectively blocks intercepted network traffic between the at least two networked devices on the local network.
Claims16
A method of isolating networked devices on a local network using a networked security device, comprising:
- performing Internet Protocol spoofing in the networked security device to intercept network traffic between at least two networked devices on the same local network as the networked security device;
- determining, based on behavioral or packet-level analysis of network activity, that one of the at least two networked devices is infected, insecure, or untrusted and identifying the infected, insecure, or untrusted device;
- in response to the identification, automatically modifying at least one of an Address Resolution Protocol (ARP) table entry or a firewall routing rule to isolate the identified device from other devices on the local network while maintaining communication between the identified device and an external network;
- monitoring the local network for ARP packets to or from the identified device;
- detecting that an ARP packet exchange has occurred that would cause the networked security device to become unspoofed and removed from between the identified device and another local network device, such that the networked security device is no longer positioned therebetween;
- delaying sending a spoofed ARP packet until completion of the detected ARP packet exchange, including delaying for a period of more than two milliseconds after detecting the ARP packet exchange;
- and
- sending multiple spoofed ARP packets at different times over a period of time in response to the detecting and following completion of the detected ARP packet exchange to reinsert the networked security device between the identified device and the other local network devices.
5 more elements
A network security device, comprising:
- a processor and a memory;
- a malware protection module implemented as software instructions stored in the memory and executed by the processor to analyze network packet content and behavior to determine that a networked device is infected, insecure, or untrusted and identifying the infected, insecure, or untrusted device;
- and
- in response to the determination, automatically modifying at least one of an Address Resolution Protocol (ARP) table entry or a firewall routing rule to isolate the identified device from other devices on the local network while maintaining communication between the identified device and an external network;
- wherein the instructions, when executed by the processor, further cause the network security device to:
- monitor the local network for ARP packets to or from the identified device;
- detect that an ARP packet exchange has occurred that would cause the network security device to become unspoofed and removed from between the identified device and another local network device, such that the network security device is no longer positioned therebetween;
- delay sending a spoofed ARP packet until completion of the detected ARP packet exchange, including delaying for a period of two or more milliseconds after detecting the ARP packet exchange;
- and
- send multiple spoofed ARP packets at different times over a period of time in response to the detecting and following completion of the detected ARP packet exchange to reinsert the network security device between the identified device and the other local network devices.
7 more elements
A method of isolating networked devices on a local network using a networked security device, comprising:
- performing Address Resolution Protocol (ARP) spoofing by the networked security device to intercept network traffic between at least a first networked device and other local network devices on the same local network as the networked security device;
- transmitting a spoofed ARP packet from the networked security device to the first networked device to redirect the first networked device's local traffic to the networked security device;
- and
- selectively discarding packets addressed to the other local network devices on the same local network while forwarding packets addressed to an external network, thereby isolating the first device from the local network while maintaining its external network connectivity;
- monitoring the local network for ARP packets from the first networked device;
- detecting that an ARP broadcast from the first networked device would cause the networked security device to become unspoofed and removed from between the first networked device and another local network device;
- delaying transmission of a spoofed ARP reply until completion of the detected ARP packet exchange, including delaying for a period of two or more milliseconds;
- and
- sending multiple spoofed ARP replies at different times over a period of time in response to the detecting and following completion of the detected ARP packet exchange to maintain isolation of the first device from the local network.
6 more elements
Dependencies are inferred from the claim text.