Patent ID: 7644151
Filing Date: 2010-01-05
Classification: G06F,H04L

Abstract:
1. In a computer network wherein packets are communicated between devices, a method for a network device to determine and block unauthorized network usage, comprising the steps within the network device of: reading the network device a configuration file that includes data selectively assigning a plurality of devices into a plurality of zones where devices in a first zone are not authorized to communicate with devices in a second zone, a zone comprising a plurality of devices that are authorized to communicate: receiving unauthorized zone data from the configuration file specifying designated zones for which devices in a particular zone are not authorized to communicate with other devices in a different unauthorized zone; passively monitoring network communications of the computer network by monitoring packets communicated between devices that have been assigned to the plurality of zones; capturing packet header information from monitored network communications; determining which devices are participating in the monitored network communications based on captured packet header information; determining the zones participating in the monitored zone communications based upon the unauthorized zone data; determining unauthorized network usage based upon the unauthorized zone data and captured packet header information indicating that a device in a first zone is attempting to communicate with a device in a second but unauthorized zone; and generating an alarm upon detection of unauthorized network usage, wherein the step of generating an alarm includes providing an address to a filtering table to block the unauthorized network usage.