Abstract:
In one embodiment, the methods and apparatuses to assign a routing address to a wireless computer that is in a different logical network from the routing addresses of other wireless computers within the same physical wireless network; and to prevent a wireless computer from learning the routing address of another wireless computer within the same physical wireless network.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
     The present application is a continuation of U.S. patent application Ser. No. 11/248,848 filed on Oct. 12, 2005, entitled “Systems and Methods for a Self-Defending Computer Network” listing the same inventor, which claims the benefit of U.S. Provisional Patent Application No. 60/617,979 filed on Oct. 12, 2004, entitled “Systems and Methods for a Self-Defending Computer Network” listing the same inventor, the disclosures of which are hereby incorporated by reference. 
    
    
     FIELD 
     This invention is related to a self defending computer network in general, and in particular a self-defending wireless computer network. 
     BACKGROUND 
     There are a variety of ways that a computer can be attacked to compromise the computer&#39;s functionality. For example, viruses and worms are common attacks that are utilized to hinder the functionality of a computer. To counterbalance these attacks, there have been a proliferation in computer anti-virus software applications that attempt to identify the virus or worm and neutralize the threat of the virus or worm spreading from a local computer to another computer. 
     SUMMARY 
     In one embodiment, the methods and apparatuses to assign a routing address to a wireless computer that is in a different logical network from the routing addresses of other wireless computers within the same physical wireless network; and to prevent a wireless computer from learning the routing address of another wireless computer within the same physical wireless network. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  depicts a diagram illustrating one embodiment of a Wireless Network with Wireless Computers, an Access Gateway and Internet Servers. 
         FIG. 2  depicts a diagram illustrating one embodiment of the Address Resolution Protocol (ARP) communications between Wireless Computers and the ARP Proxy software module on the Access Gateway. 
         FIG. 3  depicts a diagram illustrating one embodiment of the Dynamic Host Control Protocol (DHCP) communications between a Wireless Computer and a 10 DHCP Server software module on the Access Gateway. 
         FIG. 4  depicts a diagram illustrating one embodiment of the Transmission Control Protocol (TCP) communications between Wireless Computers, between a Wireless Computer and an Internet Server. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     Specific reference is made in detail to the embodiments of the invention, examples of which are illustrated in the accompanying drawings and following descriptions. While the invention is described in conjunction with the embodiments, it will be understood that the embodiments are not intended to limit the scope of the invention. The various embodiments are intended to illustrate the invention in different applications. Further, specific details are set forth in the embodiments for exemplary purposes and are not intended to limit the scope of the invention. In other instances, well-known methods, procedures, and components have not been described in detail as not to unnecessarily obscure aspects of the invention. 
     Referring to  FIG. 1 , this illustrates wireless computer network ( 100 ), such as an IEEE 802.11 based one, with a connection to the Internet ( 102 ) via an Access Gateway ( 106 ). In one embodiment, the wireless computers ( 104 ) are mobile and may enter and leave the wireless computer network at anytime. They also may access various Servers ( 110 ) out on the Internet ( 102 ) or on a corporate wired Intranet. 
     Referring to  FIG. 2 , this illustrates a Wireless Network ( 200 ) with a Wireless Computer A ( 202 ) that has been infected with a network aware virus ( 210 ), or Internet worm, that is actively trying to find another Wireless Computer ( 204 ) to infect. In one embodiment, the worm or virus ( 210 ) instructs the Wireless Computer A&#39;s BIND (ARP Client) software ( 208 ) to issue a series of ARP broadcasts ( 214 ) to resolve addresses within a network that are assigned to the Wireless Network ( 200 ). In one embodiment, these series of addresses are from the lowest to highest host address possible with an Internet Class address. For example the network address 84.55.0.0 has 16 bits used for host addresses, which range from 84.55.0.1 to 84.55.255.254, and has more than 64,000 addresses. 
     In one embodiment, the Access Gateway ( 206 ) has a high-performance ARP Proxy ( 212 ) that can respond quicker than Wireless Computer B&#39;s ARP response packet ( 218 ). The ARP Proxy issues a fast ARP response binding the Access Gateway&#39;s own MAC address with the IP address the worm is seeking. Thus, the Wireless Computer A&#39;s TCP/IP stack never learns Wireless Computers B&#39;s MAC address. The Access Gateway ( 206 ) is robust in the face of a subsequent attack by the worm or virus. 
     Referring to  FIG. 3 , this illustrates the Wireless Network ( 300 ) with a Wireless Computer ( 302 ) that has either just roamed into the network or has been restarted. The DHCP Client ( 306 ) within the Wireless Computer ( 302 ) periodically transmits a DHCP broadcast packet ( 310 ) requesting it&#39;s own IP address and the IP address of a gateway. The Access Gateway ( 304 ) contains a DHCP Server ( 308 ) that will respond with a DHCP response packet containing the new IP address of the Wireless Computer ( 302 ) and the Access Gateway&#39;s address for a routing gateway. The new IP address is put into a random network or subnet that doesn&#39;t already have an address assigned to another Wireless Computer. NAT software ( 312 ) running on the Access Gateway ( 304 ) will need to handle these addresses appropriately if IP packets must route outside of the Wireless Network ( 300 ). If the Wireless Computer ( 302 ) is infected with a worm, the Wireless Computer ( 302 ) is isolated from other Wireless Computers by virtue of the fact it is in it&#39;s own Internet network (or subnet). An attempt to contact an address outside of the range of addresses assigned to the network address will cause packets to be sent to the Access Gateway ( 304 ) where appropriate action can be taken to prevent the virus from spreading. 
     Referring to  FIG. 4 , this illustrates the Wireless Network ( 400 ) with a Wireless Computer A ( 402 ) communicating via TCP ( 412 ) to Wireless Computer B ( 404 ) via the Access Gateway ( 406 ) and it&#39;s IDS/IPS software ( 410 ). Wireless Computer A can also communicate via TCP ( 414 ) through the Access Gateway and via it&#39;s IDS/IPS module to an external Server ( 408 ). 
     The foregoing descriptions of specific embodiments of the invention have been presented for purposes of illustration and description. The invention may be applied to a variety of other applications. 
     They are not intended to be exhaustive or to limit the invention to the precise embodiments disclosed, and naturally many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to explain the principles of the invention and its practical application, to thereby enable others skilled in the art to best utilize the invention and various embodiments with various modifications as are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the Claims appended hereto and their equivalents.