Patent ID: 8819764
Filing Date: 2014-08-26
Classification: H04L

Abstract:
1. A network security monitoring apparatus that manages “permitted” or “not permitted” communication between all nodes connected to a network based on an access policy, comprising: one or more processors; packet monitor processing unit for monitoring packets transmitted by and received from all nodes connected to the network; policy management processing unit for managing the access policy for all nodes in the network; access control processing unit for judging whether a node is permitted to communicate with other nodes in the network or not based on the access policy; and communication blocking processing unit for blocking communication between nodes judged as “not permitted” by the access control processing unit, wherein the communication blocking processing unit generates a false media access control (FMAC)-address of the nodes judged as “not permitted” by the access control processing unit using a one-way function genFMAC with multiple input parameters and blocks communication between the nodes judged as “not permitted” by transmitting address resolution protocol (ARP) packets with the false media access control (FMAC)-address to the nodes, wherein the access control processing unit stops the communication blocking between the nodes and recovers communication between the nodes by transmitting address resolution protocol (ARP) packets with the correct media access control (MAC)-address to the nodes upon the access policy of the nodes being changed from “not permitted” to “permitted,” wherein the access control processing unit extracts one or more address resolution protocol (ARP) packets containing a false media access control (FMAC)-address from address resolution protocol (ARP) packets received by the packet monitor processing unit and judges the extracted ARP packet to be an attack packet that illegally attempts to block communication in a case where the media access control (MAC)-address of the extracted address resolution protocol (ARP) packet is not the same as the value of the false media access control (FMAC)-address, and wherein the one or more processors are configured to execute the monitoring unit, the managing unit, the judging unit, and the blocking unit.