Patent ID: 9369434
Filing Date: 2016-06-14
CPC Classification: H04L

Claim Text:
1. A computer-implemented whitelist-based network switch comprising: at least one non-transitory storage device; a processor; executing by the processor using programs and the at least one non-transitory storage device one or more units where one or more units comprise: a whitelist monitoring unit for storing a whitelist including permitted communication rules, monitoring one or more input packets through a plurality of switch interfaces based on the whitelist, and determining, by the processor, communication of each packet whether or not conforming to the whitelist; in response to determination that the communication of each packet being conformed to the whitelist, a traffic logging unit for creating a traffic log for the input packets through the plurality of switch interfaces, wherein the whitelist monitoring unit is configured to, with respect to packets conforming to the whitelist, record a number of packets or an amount of traffic generated per unit time in a policy log and, in response to determination that the communication of each packet not being conformed to the whitelist, the white monitoring unit for recording a corresponding traffic log with respect to a packet violating the whitelist, and a number of a switch interface, through which the packet is input, in a violation log, wherein the whitelist monitoring unit is configured to, when a packet violating the whitelist occurs, generate an alarm or block the packet in conformity with a preset handling rule; a switch control unit for switching packets respectively input through the plurality of switch interfaces, transferring the packets with respect to a packet violating the whitelist, to the whitelist monitoring unit, and performing a blocking operation in response to a control signal with respect to a packet violating the whitelist from the whitelist monitoring unit; a whitelist management unit for updating the whitelist and transmitting an updated whitelist to the whitelist monitoring unit, wherein the determination whether or not the communication of each packet being conformed to the whitelist is performed, by the processor according to the traffic log, policy log, and violation log that are configured to generate the whitelist, wherein the traffic log, policy log, and violation log are different from each other, and by extracting information corresponding to the whitelist, the extracted information comprising at least one of a source Internet Protocol (IP) address, a source port, a destination IP address, a destination port, and a protocol from the input packets, and the extracted information is transferred to the white monitoring unit, and wherein the whitelist includes an Internet Protocol (IP) address permitted to be accessed by each of the plurality of switch interfaces, a Media Access Control (MAC) address permitted to be accessed by each switch interface, a MAC address configured to be mapped to a single IP address, a communication rule to be followed in communication using IP addresses or switch interfaces, and a communication rule to be followed in communication between MAC addresses.