Layer-2 Switch Port Blocking for Unauthorized Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to immediately and reliably block communication of a target apparatus with multiple IP addresses and are vulnerable to ARP table overwrites and static ARP settings, making it difficult to prevent unauthorized access in networks with Layer-2 switches.
Innovation Solution
A method and program that generate and normalize a Mapping VLAN to Port (MvP) table to identify and administratively disable the Layer-2 switch port connected to the target apparatus, ensuring immediate and certain communication blocking and unblocking based on port information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If false ARP-reply packets are transmitted to block communication of the target apparatus, then communication blocking is achieved, but the blocking is not immediate or certain due to ARP table overwrites from correct ARP-reply packets received after the false packet due to network delay
Solution Approach 1:
The patent introduces a Layer-2 switch as an intermediary device between the unauthorized node and the network. The switch port connected to the unauthorized node is administratively disabled, which acts as a mediator to block communication at the physical layer. This approach bypasses the ARP protocol vulnerability where false ARP-reply packets can be overwritten by correct packets due to network delays. By disabling the switch port, the system achieves immediate and certain communication blocking without relying on ARP table manipulation.
2Ease of operation
If IP address-based blocking methods are used to block communication of the target apparatus, then blocking control is implemented, but it is difficult to block communication immediately and certainly when the target apparatus has multiple IP addresses
Solution Approach 1:
The patent extracts the MAC address information from the ARP table and uses it to identify the Layer-2 switch port connected to the unauthorized node. Instead of relying on IP address-based blocking methods that fail when the target has multiple IP addresses, the system extracts the fundamental Layer-2 identification (MAC address to port mapping) and uses this to directly disable the switch port. This extraction of the core identification mechanism bypasses the complexity and unreliability of IP address management and ensures certain blocking regardless of how many IP addresses the unauthorized node possesses.
3Stability of the object's composition
If the target apparatus has static ARP table settings, then ARP communication continues normally, but blocking control becomes ineffective as the ARP table does not update to reflect the blocked status
Solution Approach 1:
The patent inverts the traditional approach by not trying to modify the ARP table contents directly, but instead by disabling the Layer-2 switch port that connects the unauthorized node. This inversion of the control point from the ARP table (Layer-3) to the switch port (Layer-2) ensures that even if the ARP table has static settings and does not update, the physical communication path is blocked. The blocking effectiveness is achieved at the lower Layer-2 level, making the static ARP table configuration irrelevant to the blocking control effectiveness.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention provides the method and the program for controlling communication of the target apparatus, specifically, blocking the communication of the target apparatus immediately and certainly in case where illegal connection to the target apparatus is detected in the network arranged one or more Layer-2 switches. The network monitoring manager H carries out blocking communication of the target apparatus immediately and certainly by detecting automatically the Layer-2 switch port connected to the communication apparatus, that is identified as the target apparatus including illegal connection, based on the MvP table, and blocking the communication of the target apparatus by administratively disabling the Layer-2 switch port connected to the target apparatus , in case where the network monitoring manager H detects illegal connection to the communication apparatus in the network. The Mvp table is generating as follows. (1) The MvP table consisting of the mapping table M1 and the mapping table M2 is generating based on management information collected from the Layer-2 switches by network monitoring manager, wherein said mapping table M1 provides a mapping between MAC address M(Ci) of the said target apparatus Ci and port information set Row{M(Ci)} of Layer-2 switches Sj that detected said MAC address M(Ci), and said mapping table M2 provides a mapping between MAC address M(Sj) of Layer-2 switches Sj and port information set Row{M(Sj)} of Layer-2 switches Sj that detected said MAC address M(Sj); (2) Normalizing the MvP table by appropriately deleting elements of ports P(Sj,n) from the port information set Row{M(Sj)} of the mapping table M2; (3) Identifying the Layer-2 switch port connected to said target apparatus Ci based on the MvP table normalized in (2).