Node Communication Restriction via ARP Table Manipulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication networks lack effective methods to restrict nodes from communicating with each other within a broadcast domain, leading to potential security and access control issues.
Innovation Solution
A method and apparatus that utilize an address resolution table to monitor and restrict communication between nodes by generating and conveying restricting address resolution messages, including substitute physical addresses, to control access and maintain updated translation tables within the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If nodes are allowed to communicate freely in a broadcast domain, then network accessibility and communication efficiency are improved, but security and unauthorized access control deteriorate
Solution Approach 1:
The patent introduces an intermediary mechanism (the restricting apparatus that generates and conveys restricting address resolution messages) between nodes to control communication. This intermediary uses ARP protocol manipulation to mediate access decisions, allowing the network to maintain structured communication control without requiring complete network redesign, thus resolving the contradiction between free communication and security control.
Solution Approach 2:
The patent changes the parameter of physical address assignment by introducing substitute physical addresses in the address resolution table. By modifying this critical network parameter, the system can restrict communication without affecting the overall network topology or requiring changes to network infrastructure, thereby maintaining ease of operation while improving security.
2Object-affected harmful factors
If communication restriction mechanisms are implemented, then security and access control are improved, but network complexity and device complexity increase
Solution Approach 1:
The patent makes the address resolution mechanism universal by using it for both normal address translation and communication restriction functions. The same ARP protocol infrastructure handles both legitimate address resolution and security control, eliminating the need for separate restriction mechanisms and thereby minimizing the increase in network complexity while achieving enhanced security.
Solution Approach 2:
The patent creates a copy of the address resolution table structure to store restriction information. By copying the existing table format rather than creating a completely new restriction system, the patent minimizes additional complexity while achieving the desired security functionality through a familiar data structure that integrates with existing network operations.
3Measurement precision
If address resolution tables are continuously updated to track node communication, then communication monitoring and restriction accuracy are improved, but processing time and time consumption increase
Solution Approach 1:
The patent performs preliminary actions by pre-configuring the address resolution table with substitute physical addresses before actual communication restriction is needed. This allows the system to respond quickly to communication monitoring needs without performing time-consuming table updates in real-time, thereby maintaining high monitoring accuracy while minimizing processing time delays.
Data Source
AI summary
Method and system for restricting a first node in a broadcast domain of an IP (Internet Protocol) network from communicating with one or more other nodes. Each of the first node and the one or more other nodes has a respective translation table that maps an IP address to a respective physical address of all nodes with which the first node and the one or more other nodes have communicated. Embodiments of the invention describe obtaining communicated data including address resolution messages and accessing an address resolution table representative of address resolution activity in the network. Responsive to the communicated data indicating that the first node is communicating with other nodes, restricting the first node from communicating by generating and conveying a restricting address resolution message using information stored in the address resolution table, the restricting address resolution message including a substitute physical address.