Patent US5805801A successfully refreshed from Google Patents.
US5805801A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for detecting and preventing security
Assignee: Trend Micro Inc
•
Filing: 1997-01-09
•
Granted: 1998-09-08
•
Expires: 2017-01-09
Abstract
Abstract A system and method for providing security against intrusion in a campus LAN network is provided. A managed hub discovers each interconnect device in the network that supports the security feature and maintains an interconnect device list of such devices, which may include token ring switches, Ethernet switches, bridges and routers. The managed hub detects an intrusion by an unauthorized address on one of its ports and notifies the interconnect devices of the intrusion by transmitting a security breach detected frame. The interconnect devices set a filter on their respective ports against the intruding unauthorized address. The interconnect devices send a filter set frame to the managed hub which reenables the port where the security intrusion occurred, after all filter set frames are received. A network management station sends a security clear condition frame to remove the filters.
Inventors
- 👤 Malcolm H. Holloway
- 👤 Thomas Joseph Prorock
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-25 23:56
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0209; H04L63/0218; H04L9/00; H04L9/40; G; G06; G06F; G06F2221/00; G06F2221/21; G06F2221/2101
Claims Analysis
Total Claims: 63
Claim 1
Independent Claim
98 words
A method for providing security against intrusion in a computer network having a plurality of managed devices, said method comprising the steps of: discovering by a first managed device each of said plurality of managed devices that are enabled to provide network security; detecting an unauthorized address on a first port of said first managed device and disabling said first port; setting a filter at each of said plurality of managed devices to prevent frames having the unauthorized address from being forwarded through said computer network; and reenabling said first port after said filtering step has been completed.
Claim 2
Independent Claim
98 words
A method for providing security against intrusion in a computer network having a plurality of managed devices, said method comprising the steps of: discovering by a first managed device each of said plurality of managed devices that are enabled to provide network security; detecting an unauthorized address on a first port of said first managed device and disabling said first port; setting a filter at each of said plurality of managed devices to prevent frames having the unauthorized address from being forwarded through said computer network; and reenabling said first port after said filtering step has been completed.
Claim 3
Dependent Claim
31 words
The method for providing security against intrusion of claim 1 further comprising the step of removing of said filter that had been set at each of said plurality of managed devices.
Claim 4
Dependent Claim
19 words
The method for providing security against intrusion of claim 1 wherein said first managed device is a managed hub.
Claim 5
Dependent Claim
18 words
The method for providing security against intrusion of claim 1 wherein said first managed device is a switch.
Claim 6
Dependent Claim
21 words
The method for providing security against intrusion of claim 1 wherein said plurality of managed devices includes a token ring switch.
Claim 7
Dependent Claim
20 words
The method for providing security against intrusion of claim 1 wherein said plurality of managed devices includes an Ethernet switch.
Claim 8
Dependent Claim
19 words
The method for providing security against intrusion of claim 1 wherein said plurality of managed devices includes a bridge.
Claim 9
Dependent Claim
19 words
The method for providing security against intrusion of claim 1 wherein said plurality of managed devices includes a router.
Claim 10
Dependent Claim
19 words
The method for providing security against intrusion of claim 1 wherein said computer network includes a local area network.
Claim 11
Dependent Claim
42 words
The method for providing security against intrusion of claim 1 further comprising the steps of building and maintaining an authorized address list at said first managed device of addresses that are allowed to connect to each port in said first managed device.
Claim 12
Dependent Claim
26 words
The method for providing security against intrusion of claim 10 wherein each entry in said authorized address list includes a port number and an authorized address.
Claim 13
Dependent Claim
93 words
The method for providing security against intrusion of claim 1 wherein said discovering step includes the steps of: transmitting a discovery request frame by said first managed device, said discovery request frame having a security feature group address; receiving said discovery request frame at each of said plurality of managed devices and transmitting a discovery response frame back to said first managed device; building and maintaining an interconnect device list at said first managed device of said plurality of managed devices that transmitted said discovery response frame back to said first managed device.
Claim 14
Dependent Claim
41 words
The method for providing security against intrusion of claim 12 wherein each entry in said interconnect device list includes an address of the managed device that sent the discovery response frame and a time stamp extracted from said discovery response frame.
Claim 15
Dependent Claim
56 words
The method for providing security against intrusion of claim 11 wherein said detecting step includes the steps of: comparing, for each port, a source address of a station attempting to connect to said port with the authorized address list of addresses for said port and determining whether said source address is on said authorized address list.
Claim 16
Dependent Claim
77 words
The method for providing security against intrusion of claim 12 wherein following said disabling step said method further includes: sending a trap frame by said first managed device to a network management station indicating that an intrusion has been detected on said first port; and transmitting a security breach detected frame by said first managed device and having said security feature group address to said plurality of managed devices that have entries in said interconnect device list.
Claim 17
Dependent Claim
51 words
The method for providing security against intrusion of claim 15 wherein said security breach detected frame includes a source address of an unauthorized station, the port number of said first managed device at which the intrusion occurred, and a time stamp representing the time at which the unauthorized station was detected.
Claim 18
Dependent Claim
97 words
The method for providing security against intrusion of claim 16 wherein following the receiving of said security breach detected frame and setting of filters, each of said plurality of managed devices performs the additional steps of: transmitting said security breach detected frame on all ports except the port on which said each managed device received said security breach detected frame; sending a trap frame to the network management station indicating that said filter has been set as a result of receiving said security breach detected frame; and transmitting a filter set frame to said first managed device.
Claim 19
Dependent Claim
62 words
The method for providing security against intrusion of claim 17 wherein said filter set frame includes the address of said each managed device sending said filter set frame, the source address of said unauthorized station, the port number of said first managed device at which the intrusion occurred, and a time stamp representing the time at which the unauthorized station was detected.
Claim 20
Dependent Claim
36 words
The method for providing security against intrusion of claim 1 wherein following said reenabling step said first managed device sends a trap frame to a network management station indicating that said filtering step has been completed.
Claim 21
Dependent Claim
27 words
The method for providing security against intrusion of claim 2 wherein said removing step includes transmitting a security clear condition frame to said plurality of managed devices.
Claim 22
Dependent Claim
32 words
The method for providing security against intrusion of claim 2 wherein said removing step includes transmitting a security clear condition frame to a selected managed device of said plurality of managed devices.
Claim 23
Dependent Claim
22 words
The method for providing security against intrusion of claim 20 or 21 wherein said security clear condition frame includes said unauthorized address.
Claim 24
Independent Claim
110 words
A system for providing security against intrusion in a computer network having a plurality of managed devices, said system comprising: means for discovering at a first managed device each of said plurality of managed devices that are enabled to provide network security; means for detecting an unauthorized address on a first port of said first managed device and means for disabling said first port; means for setting a filter at each of said plurality of managed devices to prevent frames having the unauthorized address from being forwarded through said computer network; and means for reenabling said first port of said first managed device after said filtering step has been completed.
Claim 25
Independent Claim
110 words
A system for providing security against intrusion in a computer network having a plurality of managed devices, said system comprising: means for discovering at a first managed device each of said plurality of managed devices that are enabled to provide network security; means for detecting an unauthorized address on a first port of said first managed device and means for disabling said first port; means for setting a filter at each of said plurality of managed devices to prevent frames having the unauthorized address from being forwarded through said computer network; and means for reenabling said first port of said first managed device after said filtering step has been completed.
Claim 26
Dependent Claim
44 words
The system for providing security against intrusion of claim 23 further comprising means at a network management station for generating a security clear condition frame to initiate the removing of said filter that had been set at each of said plurality of managed devices.
Claim 27
Dependent Claim
19 words
The system for providing security against intrusion of claim 23 wherein said first managed device is a managed hub.
Claim 28
Dependent Claim
18 words
The system for providing security against intrusion of claim 23 wherein said first managed device is a switch.
Claim 29
Dependent Claim
21 words
The system for providing security against intrusion of claim 23 wherein said plurality of managed devices includes a token ring switch.
Claim 30
Dependent Claim
20 words
The system for providing security against intrusion of claim 23 wherein said plurality of managed devices includes an Ethernet switch.
Claim 31
Dependent Claim
19 words
The system for providing security against intrusion of claim 23 wherein said plurality of managed devices includes a bridge.
Claim 32
Dependent Claim
19 words
The system for providing security against intrusion of claim 23 wherein said plurality of managed devices includes a router.
Claim 33
Dependent Claim
19 words
The system for providing security against intrusion of claim 23 wherein said computer network includes a local area network.
Claim 34
Dependent Claim
41 words
The system for providing security against intrusion of claim 23 further comprising means for building and maintaining an authorized address list at said first managed device of addresses that are allowed to connect to each port in said first managed device.
Claim 35
Dependent Claim
26 words
The system for providing security against intrusion of claim 32 wherein each entry in said authorized address list includes a port number and an authorized address.
Claim 36
Dependent Claim
99 words
The system for providing security against intrusion of claim 23 wherein said means for discovering includes: means for transmitting a discovery request frame by said first managed device, said discovery request frame having a security feature group address; means for receiving said discovery request frame at each of said plurality of managed devices and means for transmitting a discovery response frame back to said first managed device; means for building and maintaining an interconnect device list at said first managed device of said plurality of managed devices that transmitted said discovery response frame back to said first managed device.
Claim 37
Dependent Claim
41 words
The system for providing security against intrusion of claim 34 wherein each entry in said interconnect device list includes an address of the managed device that sent the discovery response frame and a time stamp extracted from said discovery response frame.
Claim 38
Dependent Claim
58 words
The system for providing security against intrusion of claim 33 wherein said means for detecting includes: means for comparing, for each port, a source address of a station attempting to connect to said port with the authorized address list of addresses for said port and means for determining whether said source address is on said authorized address list.
Claim 39
Dependent Claim
74 words
The system for providing security against intrusion of claim 34 further including: means for sending a trap frame by said first managed device to a network management station indicating that an intrusion has been detected on said first port; and means for transmitting a security breach detected frame by said first managed device and having said security feature group address to said plurality of managed devices that have entries in said interconnect device list.
Claim 40
Dependent Claim
51 words
The system for providing security against intrusion of claim 37 wherein said security breach detected frame includes a source address of an unauthorized station, the port number of said first managed device at which the intrusion occurred, and a time stamp representing the time at which the unauthorized station was detected.
Claim 41
Dependent Claim
87 words
The system for providing security against intrusion of claim 38 wherein each of said plurality of managed devices further comprises: means for transmitting said security breach detected frame on all ports except the port on which said each managed device received said security breach detected frame; means for sending a trap frame to the network management station indicating that said filter has been set as a result of receiving said security breach detected frame; and means for transmitting a filter set frame to said first managed device.
Claim 42
Dependent Claim
62 words
The system for providing security against intrusion of claim 39 wherein said filter set frame includes the address of said each managed device sending said filter set frame, the source address of said unauthorized station, the port number of said first managed device at which the intrusion occurred, and a time stamp representing the time at which the unauthorized station was detected.
Claim 43
Dependent Claim
43 words
The system for providing security against intrusion of claim 23 wherein said first managed device further comprises means for sending a trap frame to a network management station indicating that said filter has been set at each of said plurality of managed devices.
Claim 44
Dependent Claim
20 words
The system for providing security against intrusion of claim 24 wherein said security clear condition frame includes said unauthorized address.
Claim 45
Independent Claim
117 words
A method for providing security against intrusion in a computer network having a managed hub and at least one interconnect device, said method comprising the steps of: building and maintaining an authorized address list at said managed hub of addresses that are allowed to connect to each port in said managed hub; discovering by said managed hub each interconnect device that is enabled to provide network security; detecting an unauthorized address on a first port of said managed hub and disabling said first port; setting a filter at each interconnect device to prevent frames having the unauthorized address from being forwarded through said computer network; and reenabling said first port after said filtering step has been completed.
Claim 46
Independent Claim
117 words
A method for providing security against intrusion in a computer network having a managed hub and at least one interconnect device, said method comprising the steps of: building and maintaining an authorized address list at said managed hub of addresses that are allowed to connect to each port in said managed hub; discovering by said managed hub each interconnect device that is enabled to provide network security; detecting an unauthorized address on a first port of said managed hub and disabling said first port; setting a filter at each interconnect device to prevent frames having the unauthorized address from being forwarded through said computer network; and reenabling said first port after said filtering step has been completed.
Claim 47
Dependent Claim
27 words
The method for providing security against intrusion of claim 43 further comprising the step of removing of said filter that had been set at each interconnect device.
Claim 48
Dependent Claim
30 words
The method for providing security against intrusion of claim 43 wherein said at least one interconnect device includes a token ring switch, an Ethernet switch, a bridge or a router.
Claim 49
Dependent Claim
83 words
The method for providing security against intrusion of claim 43 wherein said discovering step includes the steps of: transmitting a discovery request frame by said managed hub, said discovery request frame having a security feature group address; receiving said discovery request frame at each interconnect device and transmitting a discovery response frame back to said managed hub; building and maintaining an interconnect device list at said managed hub of each interconnect device that transmitted said discovery response frame back to said managed hub.
Claim 50
Dependent Claim
56 words
The method for providing security against intrusion of claim 46 wherein said detecting step includes the steps of: comparing, for each port, a source address of a station attempting to connect to said port with an authorized address list of addresses for said port and determining whether said source address is on said authorized address list.
Claim 51
Dependent Claim
74 words
The method for providing security against intrusion of claim 46 wherein following said disabling step said method further includes: sending a trap frame by said managed hub to a network management station indicating that an intrusion has been detected on said first port; and transmitting a security breach detected frame by said managed hub and having said security feature group address to each interconnect device that has an entry in said interconnect device list.
Claim 52
Dependent Claim
92 words
The method for providing security against intrusion of claim 48 wherein following the receiving of said security breach detected frame and setting of filters, each interconnect device performs the additional steps of: transmitting said security breach detected frame on all ports except the port on which said each interconnect device received said security breach detected frame; sending a trap frame to the network management station indicating that said filter has been set as a result of receiving said security breach detected frame; and transmitting a filter set frame to said managed hub.
Claim 53
Dependent Claim
35 words
The method for providing security against intrusion of claim 43 wherein following said reenabling step said managed hub sends a trap frame to a network management station indicating that said filtering step has been completed.
Claim 54
Dependent Claim
25 words
The method for providing security against intrusion of claim 44 wherein said removing step includes transmitting a security clear condition frame to each interconnect device.
Claim 55
Independent Claim
130 words
A system for providing security against intrusion in a computer network having a managed hub and at least one interconnect device, said system comprising: means for building and maintaining an authorized address list at said managed hub of addresses that are allowed to connect to each port in said managed hub; means for discovering by said managed hub each interconnect device that is enabled to provide network security; means for detecting an unauthorized address on a first port of said managed hub and means for disabling said first port; means for setting a filter at each interconnect device to prevent frames having the unauthorized address from being forwarded through said computer network; and means for reenabling said first port of said managed hub after said filtering step has been completed.
Claim 56
Independent Claim
130 words
A system for providing security against intrusion in a computer network having a managed hub and at least one interconnect device, said system comprising: means for building and maintaining an authorized address list at said managed hub of addresses that are allowed to connect to each port in said managed hub; means for discovering by said managed hub each interconnect device that is enabled to provide network security; means for detecting an unauthorized address on a first port of said managed hub and means for disabling said first port; means for setting a filter at each interconnect device to prevent frames having the unauthorized address from being forwarded through said computer network; and means for reenabling said first port of said managed hub after said filtering step has been completed.
Claim 57
Dependent Claim
40 words
The system for providing security against intrusion of claim 52 further comprising means at a network management station for generating a security clear condition frame to initiate the removing of said filter that had been set at each interconnect device.
Claim 58
Dependent Claim
30 words
The system for providing security against intrusion of claim 52 wherein said at least one interconnect device includes a token ring switch, an Ethernet switch, a bridge or a router.
Claim 59
Dependent Claim
89 words
The system for providing security against intrusion of claim 52 wherein said means for discovering includes: means for transmitting a discovery request frame by said managed hub, said discovery request frame having a security feature group address; means for receiving said discovery request frame at each interconnect device and means for transmitting a discovery response frame back to said managed hub; means for building and maintaining an interconnect device list at said managed hub of each interconnect device that transmitted said discovery response frame back to said managed hub.
Claim 60
Dependent Claim
58 words
The system for providing security against intrusion of claim 55 wherein said means for detecting includes: means for comparing, for each port, a source address of a station attempting to connect to said port with an authorized address list of addresses for said port and means for determining whether said source address is on said authorized address list.
Claim 61
Dependent Claim
71 words
The system for providing security against intrusion of claim 55 further including: means for sending a trap frame by said managed hub to a network management station indicating that an intrusion has been detected on said first port; and means for transmitting a security breach detected frame by said managed hub and having said security feature group address to each interconnect device that has an entry in said interconnect device list.
Claim 62
Dependent Claim
82 words
The system for providing security against intrusion of claim 57 wherein each interconnect device further comprises: means for transmitting said security breach detected frame on all ports except the port on which said each interconnect device received said security breach detected frame; means for sending a trap frame to the network management station indicating that said filter has been set as a result of receiving said security breach detected frame; and means for transmitting a filter set frame to said managed hub.
Claim 63
Dependent Claim
38 words
The system for providing security against intrusion of claim 52 wherein said managed hub further comprises means for sending a trap frame to a network management station indicating that said filter has been set at each interconnect device.
References Cited (Backward Citations)
US4930159A
Cited
US5337309A
Cited
US5177788A
Cited
US5305385A
Cited
US5537099A
Cited
US5311593A
Cited
US5610981A
Cited
US5440723A
Cited
US5414833A
Cited
US5606668A
Cited
US5727146A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-09-07 | 2002-03-09 | 2002-09-08 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-09-07 | 2006-03-09 | 2006-09-08 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-09-07 | 2010-03-09 | 2010-09-08 | $7700.00 | Window Closed / Lapsed |