Hardware address adaptation

[0002] This application claims benefit of U.S. Provisional Application No. 60/228,169 filed Aug. 28, 2000, which is hereby incorporated by reference.

[0003] 1. Field of the Invention

[0004] The present invention relates generally to providing link layer address transparency for security devices installed in Internet-connected local area networks, and more particularly to an apparatus and method for changing the Ethernet Media Access Control (MAC) address at each port of a two-port device to match those of neighboring devices connected to the opposite port.

[0005] 2. Related Art

[0006] A local area network (LAN) may have a number of network nodes, such as personal computers, connected through an Ethernet data transmission line. The network may be connected, through a router, to a wide area network (WAN) to allow sharing of information with other computers or networks. An example of a WAN to which many LANs are connected is the Internet, which is presently the largest WAN in the world.

[0007] A LAN typically will include security devices, e.g., a firewall, to protect the network from unauthorized access and other forms of electronic intrusion or attack. Advances in the techniques used to electronically attack Internet-connected networks, however, has led to the need for multi-layered security systems between the router, which connects the network to the Internet, and the firewall, which is connected to the network server. This portion of the network (including the router) usually is not secure and therefore may be subject to unauthorized monitoring.

[0008] Many types of electronic attack begin with the monitoring of network traffic in this unsecure portion of the network. In general, as data packets travel through the network, each device replaces its hardware address in the address header of received data packets with the hardware address of the next device in the network. The hardware address of the device is referred to as a link-layer address, which may be, for example, an Ethernet MAC address. An adversary can monitor the addresses contained in the data packets to identify any changes in the network, such as the addition of a new security device.

[0009] For example, an adversary may monitor network traffic for an extended period of time. If a new security device is added to the network, the adversary may detect the new Ethernet address corresponding to the new device. From this, the adversary may surmise that the network administrator has detected the unauthorized monitoring and has added a new security device in response. Moreover, the adversary then will know that the network in question is capable of supporting such security devices and therefore is relatively sophisticated. From this, the adversary may surmise that the network contains valuable information. Consequently, it is desirable to provide a means for preventing the unauthorized detection of network security devices through Ethernet address monitoring.

[0010] In another application, it may be desirable to add monitoring devices to a network without these devices being detected by the LAN users and administrators. For example, law enforcement may be authorized to install a device to monitor LAN traffic. In such a case, it is desirable for the monitoring device to have the capability to prevent detection through address monitoring.

[0011] It is a general object of the present invention to provide a means for preventing the unauthorized detection of network security devices through Ethernet address monitoring.

[0012] It is another object of the present invention to provide a method of hiding a device in a local network segment by assimilating the link-layer addresses of its immediate peer devices, thereby preventing the detection of the device itself or the detection of any alterations to the existing network.

[0013] It is another object of the present invention to use the Dynamic Ethernet MAC Addressing (DEMA) technique in an Ethernet network-based bastion device to dynamically reconfigure its Ethernet MAC addresses to match those of the nearest neighbors and thereby appear transparent to the surrounding network infrastructure.

[0014] It is another object of the present invention to allow monitoring devices to be added to a network without these devices being detected by the LAN users and administrators.

[0015] One aspect of the present invention provides an apparatus for adapting a link layer address of a network device. The apparatus includes a first port connected to receive data from a first network node. The first port has a link layer address and is configurable to one of a plurality of link layer addresses. A second port is connected to output the data to a second network node. The second port has a link layer address and is configurable to one of a plurality of link layer addresses. A processor adapts the link layer address of the first port to correspond to a link layer address of the second network node.

[0016] Embodiments of the present invention may include one or more of the following features. The link layer address of first port may be an Ethernet MAC address. The processor may query the second network node to obtain the link layer address of the second network node. The processor may query the second network node to obtain the link layer address of the second network node using Ethernet address resolution protocol. The link layer address of the second network node may be stored in a memory of the processor.

[0017] The processor may adapt the link layer address of the second port to correspond to a link layer address of the first network node. The link layer address of the second port may be an Ethernet MAC address. The processor may query the first network node to obtain the link layer address of the first network node. The processor may query the first network node to obtain the link layer address of the first network node using Ethernet address resolution protocol. The link layer address of the first network node may be stored in a memory of the processor.

[0018] Another aspect of the present invention provides an apparatus for adapting a link layer address of a network node. The apparatus includes a bus for carrying data. The apparatus further includes a first interface card connected to receive the data from a first network node and output the data to the bus. The first interface card has a link layer address and is configurable to one of a plurality of link layer addresses.

[0019] A second interface card is connected to receive the data from the bus and output the data to a second network node. The second interface card has a link layer address and is configurable to one of a plurality of link layer addresses.

[0020] A processor is connected to the first and second interface cards. The processor adapts the link layer address of the first interface card to correspond to a link layer address of the second network node.

[0021] Embodiments of the present invention may include one or more of the following features. The processor may query the second network node to obtain the link layer address of the second network node. The processor may adapt the link layer address of the second interface card to correspond to a link layer address of the first network node.

[0022] These and other objects, features and advantages will be apparent from the following description of the preferred embodiments of the present invention.

[0023] The present invention will be more readily understood from a detailed description of the preferred embodiments taken in conjunction with the following figures.

[0024] FIG. 1 is a block diagram schematically illustrating local area networks connected to the Internet;

[0025] FIG. 2 is a block diagram schematically illustrating a network node with a TCP/IP protocol suite;

[0026] FIG. 3 is a diagram of the data structure of an RFC 894 Ethernet frame containing an IP datagram;

[0027] FIG. 4 is a block diagram of a network having a DEMA-enabled device positioned between a router and a firewall;

[0028] FIG. 5 is a block diagram of a DEMA-enabled bastion host.

[0029] As shown in FIG. 1, an Internet-connected local area network (LAN) 100 may include a number of network nodes 110 connected through an Ethernet data transmission line 120. These nodes 110 may be computers, such as a personal computers (PC), or other devices designed to communicate over a network. Every electronic device manufactured for use in Ethernet networks has a unique hardware address, which is referred to as the Ethernet Media Access Control (MAC) address. The nodes 110 transmit and receive data through their respective Ethernet ports 130 to other nodes 110 in the LAN using Ethernet MAC addresses embedded in the data packets.

[0030] The LAN 100 is connected to a router 140, which handles the transmission and reception of data packets to and from the Internet 150. A security device, such as a firewall 160, may be positioned between the router 140 and the network nodes 110 to provide security against unauthorized electronic intrusion and attack. Other security devices may be positioned between the firewall and the router to provide a multi-layered protection scheme.

[0031] One area of security concern arises from embedded hardware address information, such as Ethernet MAC addresses, in data packets travelling between the firewall 160 and the router 140. Since this portion of the network is unsecure, an adversary may gain valuable information about network security devices by monitoring this data traffic and detecting the address information.

[0032] Network security devices may be protected from unauthorized detection by employing dynamic Ethernet MAC addressing (DEMA). As further described below, a DEMA-enabled device 170 has the capability of assuming the hardware addresses of adjacent components so that it becomes essentially transparent in the hardware address space of the network. This transparency reduces the chance that the DEMA-enabled device 170 will be detected through unauthorized monitoring of the network data traffic.

[0033] FIG. 2 shows the combination of hardware, firmware and software within each network node 110 that is responsible for handling data packets within the network using the Ethernet MAC addresses. Each network node 110 has a hardware/firmware portion 210 that includes an Ethernet card 220 to transmit and receive data over the Ethernet data transmission line 120.

[0034] The data transmission line 120 can be implemented by various types of physical media, e.g., coaxial, twisted-pair, or fiber-optic cable, that can transmit and receive data at rate of 100 Mb/s. However, any physical or point-to-point wireless transmission media that supports the Ethernet protocol may be used.

[0035] Each node 110 also has a software portion 230 that includes a multi-layered suite of network protocols that enables the node to communicate with other nodes 110 in the LAN 100 and with nodes located in other Internet-connected networks. Each layer of the protocol performs the particular functions necessary to handle the various aspects of data communication over a network. The combination of these functions allows the network node to communicate with nodes in other networks that may be running a variety of different operating systems and may be located anywhere in the world.

[0036] The most commonly used protocol suite for Internet-connected networks is Transmission Control Protocol/Internet Protocol (TCP/IP), which as shown in FIG. 2, is a four-layer protocol suite.

[0037] The link layer, which is also referred to as the network interface layer, handles the interface between the network node 110 and the physical network data transmission medium, e.g., the Ethernet data transmission line 120. The link layer includes an Ethernet driver 240, which is a software module that controls the hardware on the Ethernet card 220 and the transmission and reception of data packets through the Ethernet cable 120.

[0038] FIG. 3 shows a typical structure for an RFC 894 Ethernet data packet, i.e., Ethernet frame. The Ethernet destination address (the address of the network node that is to receive the data packet) and the source address (the address of the network node that is sending the frame) are each six-byte values at the front end of the frame. The address fields are followed by a two-byte type field, which identifies the type of data, such as the IP datagram shown in this example. The data portion of the frame ranges from 46 to 1500 bytes. The data is followed by a cyclic redundancy check (CRC) for error detection.

[0039] The link layer handles the received frames in accordance with the Ethernet source and destination addresses. Each node first determines whether the source address corresponds to its MAC address. If so, then the frame is stripped of the Ethernet header and passed to the network layer, which is discussed below.

[0040] The firewall, router, and other network devices also transmit and receive data in this manner.

[0041] The data portion of the frame contains an IP datagram, which is a data structure designed for transmission over the Internet. The IP datagram has a header portion with control and error correction bytes. The header is followed by a source and destination IP address. Each computer, or node, connected to the Internet has a unique IP address. The IP addresses of the source node and the destination node are associated with a particular packet of data from the time it is transmitted by the source node until it is received by the destination node.

[0042] Referring again to FIG. 2, the network layer includes a software module 250 to process the IP addresses to perform routing of the data packets from node to node. The IP datagram is stripped of its header information and passed to the transport layer.

[0043] The transport layer controls the data flow between the network layer and the application layer of each node. In the example of FIG. 2, the transport layer employs a TCP software module 260 to control the flow of data. TCP performs such functions as dividing data received from applications 270 into appropriately sized blocks for handling by the network layer, acknowledging received packets, and setting timeouts to ensure that the other node acknowledges transmitted packets. Through these functions, the TCP module 260 provides a reliable flow of data across the network and eliminates the need for the application programs 270 to handle these functions.

[0044] The application layer includes the particular applications 270 running on the network node that may require the transmission or reception of data over the network, including email programs, web browsers, etc.

[0045] Dynamic Ethernet MAC addressing (DEMA) allows a device to assume the link layer addresses of neighboring devices, rather than having its own link layer address. Consequently, an adversary monitoring the data packets traveling between the router and the firewall will not detect an address for the DEMA-enabled device and therefore will not be alerted to the presence of the device.

[0046] DEMA may be implemented in a variety software and firmware configurations. For example, as shown in FIG. 4, a DEMA-enabled network security device 170 may be positioned between the router 140 and the firewall 160. The device has software and/or firmware that automatically configures the Ethernet addresses at its ports to match those of the network devices connected to the opposite ports. In alternative embodiments, the firewall 160 or the router 140 themselves may be DEMA-enabled.

[0047] In the example of FIG. 4, the DEMA-enabled security device 170 is installed between the router 140, which has an Ethernet address of, e.g., 0xAABBCCDDEEFF, and the firewall 160 which has an Ethernet address of, e.g., 0x112233445566. The DEMA-enabled device 170 has two ports, an Internet-facing port 410 and a network-facing port 420, and is connected in series in the network between the router 140 and the firewall 160. Upon installation, the DEMA-enabled device queries the devices connected to its two ports, i.e., the router and the firewall, to determine their link layer addresses, e.g., Ethernet addresses. This may be done, for example, using an Ethernet address resolution protocol (ARP) request, which causes devices receiving the request to output their Ethernet addresses. Alternatively, the DEMA-enabled device may be directly programmed with the Ethernet addresses of its neighboring devices.

[0048] The DEMA-enabled device then configures each of its ports to have an Ethernet address corresponding to the device connected to the opposite port. In this example, the Internet-facing port 410 of the DEMA-enabled device 170 is configured to have the address of the firewall (0x112233445566) and the network-facing port 420 is configured to have the address of the router (0xAABBCCDDEEFF).

[0049] Data packets received from the Internet 150 having a destination address of 0xAABBCCDDEEFF are received by the router 140 through its Internet-facing port 430. The router 140 strips the header and replaces it with one having the router address (0xAABBCCDDEEFF) as the source address and the firewall address (0x112233445566) as the destination address. The router 140 then outputs the data packet through its network-facing port 440.

[0050] The DEMA-enabled device 170 receives the data packet from the router 140 through its Internet-facing port 410, which has assumed the address of the firewall, and processes it. The DEMA-enabled device 170 leaves the header unchanged so that it has the router address (0xAABBCCDDEEFF) as the source address and the firewall address (0x112233445566) as the destination address when it is output through the network-facing port 420 of the DEMA-enabled device 170 to the firewall 160.

[0051] The firewall 160 receives the data packet at its Internet-facing port 450 and processes it. The firewall 160 replaces the header with one having the address of a particular network node 110 as the destination address and the firewall address (0x112233445566) as the source address. The firewall 160 then outputs the data packet through its network-facing port 460 to the Ethernet data cable 120 that connects to the network nodes.

[0052] As shown in FIG. 5, a PC may be configured as a DEMA-enabled bastion host 500 to protect a network from unauthorized intrusion and attack. The bastion host 500 is a two-port device that is connected in series in a network to act as a buffer between the network nodes and the Internet, e.g., installed between a router and a firewall. The host has a central processing unit (CPU) 510, read only and random access memory (ROM/RAM) 520, and an input/output bus (I/O bus) 530. The CPU 510 and ROM/RAM 520 run software modules that implement DEMA, a network protocol suite, such as TCP/IP, and the bastion host security functions to be performed by the host 500.

[0053] Two configurable Ethernet cards 540 and 550 are connected to the I/O bus 530, each of which includes firmware allowing the card to be configured to a different Ethernet address. Each card 540 and 550 is connected to a different one of the two ports of the device 130. In this example, one of the cards 550 is configured by DEMA software to have the same Ethernet address as the router (0xAABBCCDDEEFF) and the other card 540 is configured to have the same Ethernet address as the fire wall (0x112233445566). The device handles data packets in a manner similar to that discussed above with respect to FIG. 4.

[0054] Each of the embodiments discussed above provides a novel link layer address adaptation system and method that achieves the above-discussed objects of the present invention.

[0055] In addition, because the DEMA-enabled device does not have its own link layer address, it has the advantage that an adversary monitoring data packets passing through the network would not be alerted to the presence of the DEMA-enabled device. Moreover, because the DEMA-enabled device determines (or is programmed with) the link layer addresses of adjacent devices and assigns these addresses to a port opposite to the respective adjacent device, the DEMA-enabled device has the advantage of appearing to be transparent in the link layer address space.

[0056] It will be appreciated that a DEMA-enabled monitoring device may be used to monitor a network without being detected by the LAN users, administrators, or other parties accessing the network. Such a monitoring device has the advantage of being able to prevent the detection thereof by address monitoring of data packets or execution of tracing or routing programs.

[0057] While the present invention has been described with respect to what is presently considered to be the preferred embodiments, it is to be understood that the invention is not limited to the disclosed embodiments. To the contrary, the invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

[0058] For example, and without limitation, while the discussion of DEMA has been focused on the RFC 894 Ethernet link-layer protocol, this technique can be readily implemented on other device-addressable link-layer protocols. Other such protocols include IEEE 802.3 Carrier Sense/Multiple Access with Collision Detection (CSMA/CD), IEEE 802.4 Token Bus, IEEE 802.5 Token Ring, Fast Ethernet, Fiber-Distributed Data Interface (FDDI), and Asynchronous Transfer Mode (ATM). Other protocols are feasible as well.