Network Relay Device Preventing Irregular Terminal Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network relay technologies fail to effectively prevent irregular terminals with manually set IP and MAC addresses from connecting to the network, as they do not account for the possibility of MAC address manipulation, leading to potential unauthorized communication.
Innovation Solution
A network relay device equipped with an acquiring module, a regular terminal information storing module, and a determination process module that identifies irregular communication by matching layer 2 and layer 3 addresses, VLAN information, and port details to stored regular terminal information, thereby discarding frames from irregular terminals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DHCP snooping and IP Source Guard are used to filter terminals by IP address, port, and VLAN, then communication by terminals with manually set IP addresses can be prevented, but irregular terminals with manually set MAC addresses identical to regular terminals can still connect to different ports or VLANs
Solution Approach 1:
The patent combines layer 2 address (MAC address), layer 3 address (IP address), VLAN information, and port information into a unified terminal information record. This merging of multiple identification layers allows the system to comprehensively verify terminal legitimacy by checking all four parameters simultaneously, preventing irregular terminals from bypassing security through single-parameter manipulation.
Solution Approach 2:
The patent adds VLAN information and port information as additional dimensions to the traditional MAC address and IP address verification. By expanding the verification from two dimensions (MAC and IP) to four dimensions (MAC, IP, VLAN, port), the system creates a more robust security checkpoint that irregular terminals cannot easily bypass.
2Ease of operation
If IP address and MAC address are handled separately as in conventional technologies, then filtering can be performed on each address type independently, but terminals with DHCP-allocated IP address of one terminal and MAC address of another terminal cannot be prevented from irregular communication
Solution Approach 1:
The patent merges the separate handling of MAC addresses and IP addresses into a unified verification process. By storing and verifying the combination of MAC address, IP address, VLAN information, and port information together, the system ensures that all four parameters match the legitimate terminal record, preventing address spoofing attacks where an irregular terminal uses the IP address of one terminal and the MAC address of another.
3Productivity
If only IP address allocation by DHCP is monitored, then terminals without DHCP allocation can be identified, but terminals with manually set IP and MAC addresses matching regular terminal information can still perform irregular communication
Solution Approach 1:
The patent extends the detection method by combining DHCP monitoring with verification of MAC address, VLAN information, and port information. Instead of relying solely on IP address allocation status, the system verifies all four parameters together, maintaining the simplicity of automated detection while significantly improving reliability by detecting irregular terminals that attempt to match regular terminal information across multiple parameters.
Data Source
AI summary
A network relay device for relaying communication for a regular terminal via a port includes an acquiring module, a regular terminal information storing module, and a determination process module. The acquiring module acquires a regular layer 2 address, a regular layer 3 address, regular VLAN information representing a VLAN assigned to the regular terminal, and regular port information representing a port to which the regular terminal is connected. The regular terminal information storing module stores regular terminal information representing a combination of the acquired regular layer 2 address, the regular layer 3 address, the regular VLAN information, and the regular port information. The determination process module determines whether the combination of source layer 2 address, source layer 3 address, assigned VLAN, and reception port of target frame data received via the port is stored as the regular terminal information.