US5757924A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Network security device which performs MAC address translation without affecting the IP address
Assignee: Arris Solutions LLC
•
Filing: 1995-09-18
•
Granted: 1998-05-26
•
Expires: 2015-09-18
Abstract
Abstract A network security device is connected between a protected client and a network. The network security device negotiates a session key with any other protected client. Then, all communications between the two clients are encrypted. The inventive device is self-configuring and locks itself to the IP address of its client. Thus, the client cannot change its IP address once set and therefore cannot emulate the IP address of another client. When a packet is transmitted from the protected host, the security device translates the MAC address of the client to its own MAC address before transmitting the packet into the network. Packets addressed to the host, contain the MAC address of the security device. The security device translates its MAC address to the client's MAC address before transmitting the packet to the client.
Inventors
- 👤 Aharon Friedman
- 👤 Ben Zion Levy
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-04 14:19
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/04; H04L63/0428; H04L63/0442; H04L63/06; H04L63/068; H04L63/16; H04L63/164; H04L9/00; H04L9/08; H04L9/0816; H04L9/0838; H04L9/0841; H04L9/40
Claims Analysis
Total Claims: 25
Claim 1
Independent Claim
274 words
A network security device which does no routing and is configured to protect at least one particular node, the node having a first media access control (MAC) address and an Internet address and which communicates via a network, comprising: a. a first interface connected to the at least one particular node and having said first MAC address of the node; b. a second interface connected to the network and having a second MAC address, and c. a processing circuit connected to said first and second interfaces, said processing circuit: (1) for a packet received at said first interface from said one particular node and the packet having a header containing a source address that is the Internet address of the at least one particular node and said first MAC address of said one particular node, the circuit configured to replace the first MAC address contained in the received packet header with the second MAC address before said packet is transmitted into said network and leaving the Internet address unencrypted and its position in the packet header unchanged, and (2) for a packet received at said second interface from said network and the packet having a header containing a destination address that is the Internet address of the at least one particular node and said second MAC address of said second interface, the circuit configured to replace the second MAC address contained in the received packet header with said first MAC address of said at least one particular node before said packet is transmitted to the at least one particular node, and leaving the Internet address unencrypted and its position in the packet header unchanged.
Claim 2
Dependent Claim
274 words
A network security device which does no routing and is configured to protect at least one particular node, the node having a first media access control (MAC) address and an Internet address and which communicates via a network, comprising: a. a first interface connected to the at least one particular node and having said first MAC address of the node; b. a second interface connected to the network and having a second MAC address, and c. a processing circuit connected to said first and second interfaces, said processing circuit: (1) for a packet received at said first interface from said one particular node and the packet having a header containing a source address that is the Internet address of the at least one particular node and said first MAC address of said one particular node, the circuit configured to replace the first MAC address contained in the received packet header with the second MAC address before said packet is transmitted into said network and leaving the Internet address unencrypted and its position in the packet header unchanged, and (2) for a packet received at said second interface from said network and the packet having a header containing a destination address that is the Internet address of the at least one particular node and said second MAC address of said second interface, the circuit configured to replace the second MAC address contained in the received packet header with said first MAC address of said at least one particular node before said packet is transmitted to the at least one particular node, and leaving the Internet address unencrypted and its position in the packet header unchanged.
Claim 3
Dependent Claim
16 words
The network security device of claim 1 wherein said first and second interfaces are Ethernet interfaces.
Claim 4
Dependent Claim
62 words
The network security device of claim 1 wherein said processing circuit encrypts user data contained in said packet received from said at least one particular node, while said IP address contained in said header of said packet received from said at least one particular node remains unencrypted and the portion of said IP address in said header of said packet remains unchanged.
Claim 5
Dependent Claim
26 words
The network security device of claim 3 wherein said packet is a TCP packet including a TCP packet header and the TCP packet header is encrypted.
Claim 6
Dependent Claim
26 words
The network security device of claim 3 wherein said packet is a UDP packet including a UDP packet header and the UDP packet header is encrypted.
Claim 7
Dependent Claim
23 words
The network security device of claim 3 wherein said processing circuit encrypts said user data using a session key and an encipherment function.
Claim 8
Dependent Claim
35 words
The network security device of claim 1 wherein said network security device maintains a first database containing information indicating an IP address and a permanent public key for one or more nodes in said network.
Claim 9
Dependent Claim
40 words
The network security device of claim 7 wherein said network security device maintains a second database indicating for one or more nodes in said network, an IP address, and a common session key with said at least one particular node.
Claim 10
Dependent Claim
19 words
The network security device of claim 8 wherein one or more nodes in said second database are unsecured nodes.
Claim 11
Dependent Claim
242 words
A network security device configured to protect at least one particular node, the node having an Internet address and which communicates via a network, comprising: a. a first interface connected to the at least one particular node and having a first MAC address, b. a second interface connected to the network and having a second MAC address, and c. a processing circuit connected to said first and second interfaces, said processing circuit: (1) for a packet received at said first interface from said one particular node and the packet having a header including a source address that is the Internet address of the at least one particular node and said first MAC address, the circuit configured to translate the first MAC address in the received packet header into the second MAC address before said packet is transmitted into said network by said second network interface and leaving the Internet address of the received packet header unencrypted; and (2) for a packet received at said second interface from said network and the packet having a header including a destination address that is the Internet address of the at least one particular node and said second MAC address of said second interface, the circuit configured to translate the second MAC address in the received packet header into the first MAC address before said packet is transmitted to said at least one particular node and leaving the Internet address of the received packet header unencrypted.
Claim 12
Dependent Claim
242 words
A network security device configured to protect at least one particular node, the node having an Internet address and which communicates via a network, comprising: a. a first interface connected to the at least one particular node and having a first MAC address, b. a second interface connected to the network and having a second MAC address, and c. a processing circuit connected to said first and second interfaces, said processing circuit: (1) for a packet received at said first interface from said one particular node and the packet having a header including a source address that is the Internet address of the at least one particular node and said first MAC address, the circuit configured to translate the first MAC address in the received packet header into the second MAC address before said packet is transmitted into said network by said second network interface and leaving the Internet address of the received packet header unencrypted; and (2) for a packet received at said second interface from said network and the packet having a header including a destination address that is the Internet address of the at least one particular node and said second MAC address of said second interface, the circuit configured to translate the second MAC address in the received packet header into the first MAC address before said packet is transmitted to said at least one particular node and leaving the Internet address of the received packet header unencrypted.
Claim 13
Independent Claim
264 words
A method for transmitting a packet into a network comprising the steps of: (1) generating a packet containing a first source MAC address of a first node, a first source IP address of said first node and a second IP address of a destination, and user data, (2) in a network security device which does no routing and is connected to said network and having said first IP address, translating said first source MAC address into a second MAC address of said network security device, encrypting said user data, while leaving said IP address of said destination unencrypted and in the same respective position in a header of said packet, wherein the step of encrypting comprises negotiating a session key common to said first node and second node, said negotiating step comprising: a. at said network security device, using a static public key of said second node, encrypting a dynamic public key of said first node and transmitting said dynamic public key of said first node to said second node, b. receiving from said second node a dynamic public key of said second node encrypted with a static public key of said first node and decrypting said dynamic public key of said second node with a static secret key of said first node at said network security device, c. at said network security device, generating said common session key from a dynamic secret key of said first host and said dynamic public key of said first node and said dynamic public key of said second node; and (3) transmitting said packet into said network.
Claim 14
Independent Claim
264 words
A method for transmitting a packet into a network comprising the steps of: (1) generating a packet containing a first source MAC address of a first node, a first source IP address of said first node and a second IP address of a destination, and user data, (2) in a network security device which does no routing and is connected to said network and having said first IP address, translating said first source MAC address into a second MAC address of said network security device, encrypting said user data, while leaving said IP address of said destination unencrypted and in the same respective position in a header of said packet, wherein the step of encrypting comprises negotiating a session key common to said first node and second node, said negotiating step comprising: a. at said network security device, using a static public key of said second node, encrypting a dynamic public key of said first node and transmitting said dynamic public key of said first node to said second node, b. receiving from said second node a dynamic public key of said second node encrypted with a static public key of said first node and decrypting said dynamic public key of said second node with a static secret key of said first node at said network security device, c. at said network security device, generating said common session key from a dynamic secret key of said first host and said dynamic public key of said first node and said dynamic public key of said second node; and (3) transmitting said packet into said network.
Claim 15
Dependent Claim
42 words
The method of claim 11 wherein said first node maintains a static database containing information which identifies static public keys of other nodes in said network and from which said network security device obtains said static public key of said second node.
Claim 16
Dependent Claim
22 words
The method of claim 12 wherein said network security device maintains a dynamic database including an indicator of said common session key.
Claim 17
Independent Claim
99 words
A method for transmitting a packet into a network comprising the steps of: (1) generating a packet whose header contains a first source media access control (MAC) address of a host, an IP address of a destination, and user data, (2) in a network security device which does no routing and is connected to said network, translating said first MAC address of said host into a second MAC address of said network security device and retaining the IP address of said destination unencrypted and in its respective position in said header, and (3) transmitting said packet into said network.
Claim 18
Independent Claim
99 words
A method for transmitting a packet into a network comprising the steps of: (1) generating a packet whose header contains a first source media access control (MAC) address of a host, an IP address of a destination, and user data, (2) in a network security device which does no routing and is connected to said network, translating said first MAC address of said host into a second MAC address of said network security device and retaining the IP address of said destination unencrypted and in its respective position in said header, and (3) transmitting said packet into said network.
Claim 19
Dependent Claim
43 words
The method of claim 14 further comprising the step of in said network security device encrypting said user data, while leaving said IP address of said destination unencrypted and retaining said IP address of said destination in its respective position in said header.
Claim 20
Dependent Claim
13 words
The method of claim 14 wherein said user data includes a TCP packet.
Claim 21
Dependent Claim
13 words
The method of claim 14 wherein said user data includes a UDP packet.
Claim 22
Independent Claim
96 words
A method for transmitting a packet into a network comprising the steps of: (1) generating a packet having a header containing a first MAC address, an IP address of a destination, and user data, (2) in a network security device which does no routing and is connected to said network, translating said first MAC address into a second MAC address of said network security device, (3) encrypting the user data and not the IP address and retaining as unchanged said IP address and its position in said header, and (4) transmitting said packet into said network.
Claim 23
Independent Claim
96 words
A method for transmitting a packet into a network comprising the steps of: (1) generating a packet having a header containing a first MAC address, an IP address of a destination, and user data, (2) in a network security device which does no routing and is connected to said network, translating said first MAC address into a second MAC address of said network security device, (3) encrypting the user data and not the IP address and retaining as unchanged said IP address and its position in said header, and (4) transmitting said packet into said network.
Claim 24
Dependent Claim
200 words
A network security device connected between: (1) a node having an Internet address and (2) a communication network, the device comprising: (a) a first interface connected to at least one node, the first interface having a first media access control (MAC) address; (b) a second interface connected to the communication network and having a second MAC address; (c) a processor connected to the first and second interfaces, the processor configured to: (1) receive a packet from the first interface, the packet having a transport layer header, a network layer header, and the first MAC address; the processor configured to replace the first MAC address with the second MAC address in the received packet, to encrypt the received transport layer header, and to not encrypt the received network layer header; and to transmit the packet to the second interface; and (2) receive a packet from the second interface, the packet having an encrypted transport layer header, an unencrypted network layer header, and the second MAC address; the processor configured to replace the second MAC address with the first MAC address in the received packet, decrypt the packet including the transport layer header, and to transmit the packet to the first interface.
Claim 25
Dependent Claim
200 words
A network security device connected between: (1) a node having an Internet address and (2) a communication network, the device comprising: (a) a first interface connected to at least one node, the first interface having a first media access control (MAC) address; (b) a second interface connected to the communication network and having a second MAC address; (c) a processor connected to the first and second interfaces, the processor configured to: (1) receive a packet from the first interface, the packet having a transport layer header, a network layer header, and the first MAC address; the processor configured to replace the first MAC address with the second MAC address in the received packet, to encrypt the received transport layer header, and to not encrypt the received network layer header; and to transmit the packet to the second interface; and (2) receive a packet from the second interface, the packet having an encrypted transport layer header, an unencrypted network layer header, and the second MAC address; the processor configured to replace the second MAC address with the first MAC address in the received packet, decrypt the packet including the transport layer header, and to transmit the packet to the first interface.
References Cited (Backward Citations)
US4182933A
Cited
US3816666A
Cited
US4185166A
Cited
US4159468A
Cited
US4160120A
Cited
US4203166A
Cited
US4227253A
Cited
US4238854A
Cited
US4249180A
Cited
US4727579A
Cited
US4633391A
Cited
US4621321A
Cited
US4701840A
Cited
US4829569A
Cited
US4757536A
Cited
US4799153A
Cited
US4713753A
Cited
US4802220A
Cited
US4901348A
Cited
US4837822A
Cited
US4731841A
Cited
US4829560A
Cited
US4933969A
Cited
US4912762A
Cited
US4956803A
Cited
US4916704A
Cited
US4924513A
Cited
US4991207A
Cited
US4980913A
Cited
US5001755A
Cited
US4910777A
Cited
US4965804A
Cited
US4933971A
Cited
US5386470A
Cited
US5161192A
Cited
US5056140A
Cited
US5204961A
Cited
US5070528A
Cited
US5086469A
Cited
US5161193A
Cited
US5309437A
Cited
US5303303A
Cited
US5245696A
Cited
US5182554A
Cited
US5272754A
Cited
US5222137A
Cited
US5179554A
Cited
US5261003A
Cited
US5177788A
Cited
US5222140A
Cited
US5583940A
Cited
US5537099A
Cited
US5276735A
Cited
US5502766A
Cited
US5499297A
Cited
US5311593A
Cited
US5432850A
Cited
US5596718A
Cited
US5268962A
Cited
US5361359A
Cited
US5489896A
Cited
US5414694A
Cited
US5406628A
Cited
US5299263A
Cited
US5444782A
Cited
US5442708A
Cited
US5353283A
Cited
US5394402A
Cited
US5331637A
Cited
US5600722A
Cited
US5386471A
Cited
US5394469A
Cited
US5416842A
Cited
US5557765A
Cited
US5557346A
Cited
US5548646A
Cited
US5590201A
Cited
US5623601A
Cited
US5550984A
Cited
US5548649A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-05-25 | 2001-11-24 | 2002-05-26 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-05-25 | 2005-11-24 | 2006-05-26 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-05-25 | 2009-11-24 | 2010-05-26 | $7700.00 | Window Closed / Lapsed |