Repeaters for secure local area networks

Claim 2

In a network communicating data frames having an identifiable destination on communication media having a particular media access protocol, a repeater comprising: at least first and second ports for connection to the communication media of the network; a frame regenerator connected between the first and second ports that repeats an incoming frame from the first port to supply a regenerated frame for retransmission on the second port within a time interval which begins before the complete incoming frame has been received by the first port; access rule logic coupled with the first port to detect incoming frames having destinations not authorized for the second port; and an override circuit, coupled to the frame regenerator and to the access rule logic, to modify the regenerated frame in response to indication by the access rule logic that the incoming frame has a destination not authorized for the second port.

Claim 3

The repeater of claim 1, wherein the access rule logic, comprises: sampling circuitry to sample a destination field in an incoming frame; a destination table store to store a list of at least one authorized destination in the network for access through the second port; a comparator, coupled with the sampling circuitry and the destination table store, which supplies an unauthorized frame signal when the destination of the incoming frame falls outside the list of at least one authorized destination; and wherein the override circuit is responsive to the unauthorized frame signal to begin modifying the regenerated frame.

Claim 4

The repeater of claim 2, wherein the unauthorized frame signal is supplied in time to modify substantially all data in the regenerated frame.

Claim 5

The repeater of claim 2, further including: a circuit to learn a destination accessible through the second port of the repeater in response to frames received on the second port during a learning interval and to store the learned destination in the destination table store.

Claim 6

The repeater of claim 2, wherein the network communicates data frames having a preset format, the preset format having a beginning of the frame and a destination address field near the beginning of the frame, and wherein the destination table store stores a list of at least one destination address.

Claim 7

The repeater of claim 1, wherein the override circuit modifies the regenerated frame by corrupting at least most of the data in the regenerated frame.

Claim 8

For a network communicating data frames having an identifiable destination on communication media having a carrier sense multiple access with collision detection (CSMA/CD) media access protocol, a multiport repeater comprising: a plurality of ports for connection to the communication media of the network; a frame regenerator connected to the plurality of ports that repeats an incoming frame from a particular port in the plurality of ports to supply respective regenerated frames for retransmission on other ports in the plurality of ports within a time interval which begins before the complete incoming frame has been received by the particular port; access rule logic, coupled with the plurality of ports, to detect whether the incoming frame from the particular port has a destination not authorized for retransmission on the other ports on a per port basis; and an override circuit, coupled to the frame regenerator and the access rule logic, responsive to detection by the access rule logic on a per port basis that the incoming frame has a destination not authorized for retransmission on a given port in the plurality of ports to modify the regenerated frame for retransmission on the given port.

Claim 9

For a network communicating data frames having an identifiable destination on communication media having a carrier sense multiple access with collision detection (CSMA/CD) media access protocol, a multiport repeater comprising: a plurality of ports for connection to the communication media of the network; a frame regenerator connected to the plurality of ports that repeats an incoming frame from a particular port in the plurality of ports to supply respective regenerated frames for retransmission on other ports in the plurality of ports within a time interval which begins before the complete incoming frame has been received by the particular port; access rule logic, coupled with the plurality of ports, to detect whether the incoming frame from the particular port has a destination not authorized for retransmission on the other ports on a per port basis; and an override circuit, coupled to the frame regenerator and the access rule logic, responsive to detection by the access rule logic on a per port basis that the incoming frame has a destination not authorized for retransmission on a given port in the plurality of ports to modify the regenerated frame for retransmission on the given port.

Claim 10

The multiport repeater of claim 7, wherein the access rule logic, comprises: sampling circuitry to sample a destination field in the incoming frame; a destination table store, storing respective lists of at least one authorized destination in the network for access through the respective ports in the plurality of ports; a comparator, coupled with sampling circuitry and the destination table store, which supplies an unauthorized frame signal for given ports in the plurality of ports when the destination of the incoming frame falls outside the list of at least one authorized destination for the given ports; and wherein the override circuitry is responsive to the unauthorized frame signal for the given ports.

Claim 11

The multiport repeater of claim 8, wherein the unauthorized frame signal is supplied in time to modify substantially all data in the regenerated frame.

Claim 12

The multiport repeater of claim 8, further including: a circuit for learning destinations accessible through the respective ports in the plurality of ports in response to data frames received on the respective ports during a learning interval and storing the learned destinations in the destination table store.

Claim 13

The multiport repeater of claim 8, wherein the network communicates data frames having a preset format, the preset format having a beginning of the frame and a destination address field near the beginning of the frame, and wherein the destination table store stores a list of destination addresses.

Claim 14

The multiport repeater of claim 7, wherein the override circuit modifies the regenerated frame by corrupting at least most of the data in the regenerated frame.

Claim 15

In a network communicating data frames having an identifiable source on communication media having a particular media access protocol, a repeater comprising: at least first and second ports for connection to the communication media of the network; a frame regenerator connected between the first and second ports that repeats an incoming frame from the first port to supply a regenerated frame for retransmission on the second port within a time interval which begins before the complete incoming frame has been received by the first port; access rule logic coupled with the first port to detect incoming frames having sources not authorized for the first port; and an override circuit, coupled to the frame regenerator and to the access rule logic, to modify the regenerated frame in response to indication by the access rule logic that the incoming frame has a source not authorized for the first port.

Claim 16

In a network communicating data frames having an identifiable source on communication media having a particular media access protocol, a repeater comprising: at least first and second ports for connection to the communication media of the network; a frame regenerator connected between the first and second ports that repeats an incoming frame from the first port to supply a regenerated frame for retransmission on the second port within a time interval which begins before the complete incoming frame has been received by the first port; access rule logic coupled with the first port to detect incoming frames having sources not authorized for the first port; and an override circuit, coupled to the frame regenerator and to the access rule logic, to modify the regenerated frame in response to indication by the access rule logic that the incoming frame has a source not authorized for the first port.

Claim 17

The repeater of claim 13, wherein the access rule logic, comprises: sampling circuitry to sample a source field in an incoming frame; a source table store to store a list of at least one authorized source for the first port; a comparator, coupled with the sampling circuitry and the source table store, which supplies an unauthorized frame signal when the source of the incoming frame falls outside the list of at least one authorized source; and wherein the override circuit is responsive to the unauthorized frame signal to begin modifying the regenerated frame.

Claim 18

The repeater of claim 14, wherein the unauthorized frame signal is supplied in time to modify substantially all data in the regenerated frame.

Claim 19

The repeater of claim 14, further including: a circuit to learn at least one source connected to the first port of the repeater in response to frames received on the first port during a learning interval and to store the at least one learned source in the source table store.

Claim 20

The repeater of claim 14 wherein the network communicates data frames having a preset format, the preset format having a beginning of the frame and a source address field near the beginning of the frame, and wherein the source table store stores a list of at least one source address.

Claim 21

The multiport repeater of claim 13, further including a circuit for switching off the first port in response to detection of an incoming frame on the first port having a source not authorized for the first port.

Claim 22

The repeater of claim 13, wherein the override circuit modifies the regenerated frame by corrupting at least most of the data in the regenerated frame.

Claim 23

For a network communicating data frames having an identifiable source on communication media having a carrier sense multiple access with collision detection (CSMA/CD) media access protocol, a multiport repeater comprising: a plurality of ports for connection to the communication media of the network; a frame regenerator connected to the plurality of ports that repeats an incoming frame from a particular port in the plurality of ports to supply respective regenerated frames for retransmission on other ports in the plurality of ports within a time interval which begins before the complete incoming frame has been received by the particular port; access rule logic, coupled with the plurality of ports, to detect whether the incoming frame from the particular port has a source not authorized for the particular port; and an override circuit, coupled to the frame regenerator and the access rule logic, responsive to detection by the access rule logic that the incoming frame has a source not authorized for the particular port to modify the regenerated frame for retransmission on the plurality of ports.

Claim 24

For a network communicating data frames having an identifiable source on communication media having a carrier sense multiple access with collision detection (CSMA/CD) media access protocol, a multiport repeater comprising: a plurality of ports for connection to the communication media of the network; a frame regenerator connected to the plurality of ports that repeats an incoming frame from a particular port in the plurality of ports to supply respective regenerated frames for retransmission on other ports in the plurality of ports within a time interval which begins before the complete incoming frame has been received by the particular port; access rule logic, coupled with the plurality of ports, to detect whether the incoming frame from the particular port has a source not authorized for the particular port; and an override circuit, coupled to the frame regenerator and the access rule logic, responsive to detection by the access rule logic that the incoming frame has a source not authorized for the particular port to modify the regenerated frame for retransmission on the plurality of ports.

Claim 25

The multiport repeater of claim 20, wherein the access rule logic, comprises: sampling circuitry to sample a source field in the incoming frame; a source table store, storing respective lists of at least one authorized source for the respective ports in the plurality of ports; a comparator, coupled with sampling circuitry and the source table store, which supplies an unauthorized frame signal for the particular port when the source of the incoming frame falls outside the list of at least one authorized source for the particular port; and wherein the override circuitry is responsive to the unauthorized frame signal.

Claim 26

The multiport repeater of claim 21, wherein the unauthorized frame signal is supplied in time to modify substantially all data in the regenerated frame.

Claim 27

The multiport repeater of claim 21, further including: a circuit for learning sources on the respective ports in the plurality of ports in response to data frames received on the respective ports during a learning interval and storing the learned sources in the source table store.

Claim 28

The multiport repeater of claim 21, wherein the network communicates data frames having a preset format, the preset format having a beginning of the frame and a source address field near the beginning of the frame, and wherein the source table store stores a list of source addresses.

Claim 29

The multiport repeater of claim 20, further including a circuit for switching off the particular port in response to detection of an incoming frame on the particular port having a source not authorized for the particular port.

Claim 30

The multiport repeater of claim 20, where in the override circuit modifies the regenerated frame by corrupting at least most of the data in the regenerated frame.

Claim 31

For a network communicating data frames having an identifiable source on communication media having a carrier sense multiple access with collision detection (CSMA/CD) media access protocol, a multiport repeater comprising: a plurality of ports for connection to the communication media of the network; a frame regenerator connected to the plurality of ports that repeats an incoming frame from a particular port in the plurality of ports to supply respective regenerated frames for retransmission on other ports in the plurality of ports within a time interval which begins before the complete incoming frame has been received by the particular port; access rule logic, coupled with the plurality of ports, to detect whether the incoming frame from the particular port has a source not authorized for the particular port; and a switch circuit, coupled to the frame regenerator and the access rule logic, responsive to detection by the access rule logic that the incoming frame has a source not authorized for the particular port to switch off the particular port.

Claim 32

For a network communicating data frames having an identifiable source on communication media having a carrier sense multiple access with collision detection (CSMA/CD) media access protocol, a multiport repeater comprising: a plurality of ports for connection to the communication media of the network; a frame regenerator connected to the plurality of ports that repeats an incoming frame from a particular port in the plurality of ports to supply respective regenerated frames for retransmission on other ports in the plurality of ports within a time interval which begins before the complete incoming frame has been received by the particular port; access rule logic, coupled with the plurality of ports, to detect whether the incoming frame from the particular port has a source not authorized for the particular port; and a switch circuit, coupled to the frame regenerator and the access rule logic, responsive to detection by the access rule logic that the incoming frame has a source not authorized for the particular port to switch off the particular port.

Claim 33

The multiport repeater of claim 27, wherein the access rule logic, comprises: sampling circuitry to sample a source field in the incoming frame; a source table store, storing respective lists of at least one authorized source for the respective ports in the plurality of ports; a comparator, coupled with sampling circuitry and the source table store, which supplies an unauthorized frame signal for the particular port when the source of the incoming frame falls outside the list of at least one authorized source for the particular port; and wherein the switch circuit is responsive to the unauthorized frame signal.

Claim 34

The multiport repeater of claim 28, further including: a circuit for learning sources on the respective ports in the plurality of ports in response to data frames received on the respective ports during a learning interval and storing the learned sources in the source table store.

Claim 35

The multiport repeater of claim 28, wherein the network communicates data frames having a preset format, the preset format having a beginning of the frame and a source address field near the beginning of the frame, and wherein the source table store stores a list of at least one source address for the particular port.

Claim 36

For a network communicating data frames having an identifiable destination on communication media having a carrier sense multiple access with collision detection (CSMA/CD) media access protocol, a multiport repeater comprising: a plurality of ports for connection to the communication media of the network; a frame regenerator connected to the plurality of ports that repeats an incoming frame from a particular port in the plurality of ports to supply respective regenerated frames for retransmission on other ports in the plurality of ports within a time interval which begins before the complete incoming frame has been received by the particular port; access rule logic, coupled with the plurality of ports, to detect whether the incoming frame from the particular port has a destination not authorized for retransmission on the other ports on a per port basis and whether the incoming frame from the particular port has a source not authorized for the particular port; an override circuit, coupled to the frame regenerator and the access rule logic, responsive to detection by the access rule logic on a per port basis that the incoming frame has a destination not authorized for retransmission on a given port in the plurality of ports to modify the regenerated frame for retransmission on the given port; and a switch circuit, coupled to the frame regenerator and the access rule logic, responsive to detection by the access rule logic that the incoming frame has a source not authorized for the particular port to switch off the particular port.

Claim 37

For a network communicating data frames having an identifiable destination on communication media having a carrier sense multiple access with collision detection (CSMA/CD) media access protocol, a multiport repeater comprising: a plurality of ports for connection to the communication media of the network; a frame regenerator connected to the plurality of ports that repeats an incoming frame from a particular port in the plurality of ports to supply respective regenerated frames for retransmission on other ports in the plurality of ports within a time interval which begins before the complete incoming frame has been received by the particular port; access rule logic, coupled with the plurality of ports, to detect whether the incoming frame from the particular port has a destination not authorized for retransmission on the other ports on a per port basis and whether the incoming frame from the particular port has a source not authorized for the particular port; an override circuit, coupled to the frame regenerator and the access rule logic, responsive to detection by the access rule logic on a per port basis that the incoming frame has a destination not authorized for retransmission on a given port in the plurality of ports to modify the regenerated frame for retransmission on the given port; and a switch circuit, coupled to the frame regenerator and the access rule logic, responsive to detection by the access rule logic that the incoming frame has a source not authorized for the particular port to switch off the particular port.

Claim 38

The multiport repeater of claim 31, wherein the override circuit is also responsive to detection by the access rule logic that the incoming frame has a source not authorized for the particular port to modify the regenerated frame for retransmission on the plurality of ports.

Claim 39

The multiport repeater of claim 31, wherein the access rule logic, comprises: sampling circuitry to sample a source field and a destination field in the incoming frame; a source table store, storing respective lists of at least one authorized source for the respective ports in the plurality of ports; a source comparator, coupled with sampling circuitry and the source table store, which supplies an unauthorized source signal for the particular port when the source of the incoming frame falls outside the list of at least one authorized source for the particular port; and wherein the switch circuit is responsive to the unauthorized source signal; a destination table store, storing respective lists of at least one authorized destination in the network for access through the respective ports in the plurality of ports; a comparator, coupled with sampling circuitry and the destination table store, which supplies an unauthorized destination signal for given ports in the plurality of ports when the destination of the incoming frame falls outside the list of at least one authorized destination for the given ports; and wherein the override circuitry is responsive to the unauthorized destination signal for the given ports.

Claim 40

The multiport repeater of claim 33, wherein the unauthorized frame signal is supplied in time to modify substantially all data in the regenerated frame.

Claim 41

The multiport repeater of claim 33, further including: a circuit for learning destinations accessible through the respective ports in the plurality of ports in response to data frames received on the respective ports during a learning interval and storing the learned destinations in the destination table store; and a circuit for learning sources on the respective ports in the plurality of ports in response to data frames received on the respective ports during a learning interval and storing the learned sources in the source table store.

Claim 42

The multiport repeater of claim 33, wherein the network communicates data frames having a preset format, the preset format having a beginning of the frame, a destination address field near the beginning of the frame and a source address field near the beginning of the frame, and wherein the destination address table stores at least one destination address for a given port and the source table store stores at least one source address for a particular port.

Claim 43

The multiport repeater of claim 31, wherein the override circuit modifies the regenerated frame by corrupting at least most of the data in the regenerated frame.

Claim 44

For a network communicating data frames having an identifiable destination address on communication media, an apparatus comprising: a plurality of ports for connection to communication media of the network; circuitry connected to the plurality of ports that retransmits a data frame being received on a particular port on other ports in the plurality of ports independent of the identifiable destination address, and within a time interval which begins before the data frame has been received completely by the particular port; access rule logic, coupled to the plurality of ports, which detects whether the data frame being received on the particular port has a destination address not authorized for retransmission on at least one of the other ports; and override circuitry, coupled to the plurality of ports and the access rule logic, that is responsive to the detection by the access rule logic that the data frame being received has a destination address not authorized for retransmission on the at least one of the other ports, such that the override circuitry modifies at least a portion of the data frame being retransmitted on the at least one of the other ports.

Claim 45

For a network communicating data frames having an identifiable destination address on communication media, an apparatus comprising: a plurality of ports for connection to communication media of the network; circuitry connected to the plurality of ports that retransmits a data frame being received on a particular port on other ports in the plurality of ports independent of the identifiable destination address, and within a time interval which begins before the data frame has been received completely by the particular port; access rule logic, coupled to the plurality of ports, which detects whether the data frame being received on the particular port has a destination address not authorized for retransmission on at least one of the other ports; and override circuitry, coupled to the plurality of ports and the access rule logic, that is responsive to the detection by the access rule logic that the data frame being received has a destination address not authorized for retransmission on the at least one of the other ports, such that the override circuitry modifies at least a portion of the data frame being retransmitted on the at least one of the other ports.

Claim 46

The apparatus of claim 38, wherein the override circuitry modifies the portion of the data frame by corrupting the data frame, such that the corrupted data is not recoverable.

Claim 47

The apparatus of claim 38, wherein the override circuitry modifies the portion of the data frame by encrypting the data frame, such that the encrypted data is recoverable only upon decryption.

Claim 48

The apparatus of claim 38, wherein the access rule logic is implemented such that the detection of the unauthorized data frame is done on a per port basis.

Claim 49

The apparatus of claim 38, wherein the plurality of ports includes a plurality of subsets of ports, each subset having one or more ports, the subsets of ports mounted in respective, interconnected units, and the override circuitry modifies data of the incoming frame for retransmission on the other ports on a per subset basis,

Claim 50

The apparatus of claim 42, wherein the access rule logic and override circuitry are distributed among the interconnected units.

Claim 51

The apparatus of claim 38, wherein the plurality of ports includes a plurality of subsets of ports, each subset having one or more ports, the subsets being mounted in respective, interconnected units, and wherein the access rule logic is distributed among the interconnected units and detects whether the data frame being received on a particular port has a destination address not authorized for retransmission on the other ports on a per port basis.

Claim 52

The apparatus of claim 38, wherein the data frames have an identifiable source address and wherein the access rule logic includes logic to detect whether the data frame being received on the particular port has a source address not authorized for the particular port; and wherein the override circuitry is responsive to the detection by the access rule logic that the data frame being received on the particular port has a source address not authorized for the particular port such that the override circuitry prevents at least a portion of the data frame being received on the particular port from being retransmitted in an unmodified form on the other ports.

Claim 53

The apparatus of claim 38, wherein the data frames have an identifiable source address and wherein the access rule logic includes logic to detect whether the data frame being received on the particular port has a source address not authorized for the particular port; and including: disabling circuitry responsive to the detection by the access rule logic that the data frame being received on the particular port has a source address not authorized for the particular port such that the disabling circuitry disables the particular port.

Claim 54

The apparatus of claim 38, wherein the network operates according to a carrier sense, multiple access with collision detection (CSMA/CD) media access protocol, and said time interval begins within delay limits specified for the protocol.

Claim 55

For a network communicating data frames having an identifiable source address and an identifiable destination address on communication media operating according to a carrier sense, multiple access with collision detection (CSMA/CD) media access protocol, an apparatus comprising: a plurality of ports for connection to communication media of the network; circuitry connected to the plurality of ports that retransmits a data frame being received on a particular port on other ports in the plurality of ports independent of the identifiable destination address, and within a time interval which begins, within delay limits specified for the protocol, before the data frame has been received completely by the particular port; access rule logic, coupled to the plurality of ports, which detects whether the data frame being received on the particular port has a destination address not authorized for retransmission on at least one of the other ports, and wherein the access rule logic further detects whether the data frame being received on the particular port has a source address not authorized for the particular port; override circuitry, coupled to the plurality of ports and the access rule logic, that is responsive to the detection by the access rule logic that the data frame being received has a destination address not authorized for retransmission on the at least one of the other ports in a manner such that the override circuitry corrupts at least a portion of the data frame being retransmitted on the at least one of the other ports; and disabling circuitry, coupled to the plurality of ports and the access rule logic, that is responsive to the detection by the access rule logic that the data frame being received on the particular port has a source address not authorized for the particular port such that the disabling circuitry disables the particular port.

Claim 56

For a network communicating data frames having an identifiable source address and an identifiable destination address on communication media operating according to a carrier sense, multiple access with collision detection (CSMA/CD) media access protocol, an apparatus comprising: a plurality of ports for connection to communication media of the network; circuitry connected to the plurality of ports that retransmits a data frame being received on a particular port on other ports in the plurality of ports independent of the identifiable destination address, and within a time interval which begins, within delay limits specified for the protocol, before the data frame has been received completely by the particular port; access rule logic, coupled to the plurality of ports, which detects whether the data frame being received on the particular port has a destination address not authorized for retransmission on at least one of the other ports, and wherein the access rule logic further detects whether the data frame being received on the particular port has a source address not authorized for the particular port; override circuitry, coupled to the plurality of ports and the access rule logic, that is responsive to the detection by the access rule logic that the data frame being received has a destination address not authorized for retransmission on the at least one of the other ports in a manner such that the override circuitry corrupts at least a portion of the data frame being retransmitted on the at least one of the other ports; and disabling circuitry, coupled to the plurality of ports and the access rule logic, that is responsive to the detection by the access rule logic that the data frame being received on the particular port has a source address not authorized for the particular port such that the disabling circuitry disables the particular port.

Claim 57

The apparatus of claim 48, wherein the override circuitry is further responsive to the detection by the access rule logic that the data frame being received on the particular port has a source address not authorized for the particular port in a manner such that the override circuitry prevents at least a portion of the data frame being received on the particular port from being retransmitted in an unmodified form on the other ports.

Claim 58

The apparatus of claim 48, wherein the access rule logic is implemented such that the detection of the unauthorized data frame is done on a per port basis.

Claim 59

The apparatus of claim 48, wherein the plurality of ports includes a plurality of subsets of ports, each subset having one or more members, the subsets of ports mounted on respective, interconnected units, and the override circuitry modifies data of the incoming frame for retransmission on the other ports on a per subset basis.

Claim 60

The apparatus of claim 51, wherein the access rule logic and override circuitry are distributed among the interconnected units.

Claim 61

The apparatus of claim 40, wherein the plurality of ports includes a plurality of subsets of ports, each subset having one or more ports, the subsets of ports being mounted in respective, interconnected units, and the access rule logic is distributed among the interconnected units and detects whether the data frame being received on a particular port has a destination address not authorized for retransmission on the other ports on a per port basis.