Media access control address security
View Patent ↗An access interface system for interfacing between an enterprise network and a service provider network comprises an interface and a processing system. The interface is configured to receive traffic from the service provider network wherein the traffic identifies a virtual link and a media access control address, transmit the traffic to the enterprise network if the media access control address is allowed for the virtual link, and block the traffic if the media access control address is not allowed for the virtual link. The processing system is configured to determine if the media access control address is allowed for the virtual link.
1. A method of operating an access interface system to interface between a local area network and a service provider network, the method comprising:
receiving data traffic transmitted from an originating device over a virtual private network (VPN), wherein the data traffic contains a media access control (MAC) address of a device along a path between the access interface system and the originating device;
determining if the MAC address is associated with the VPN;
transmitting the data traffic to the local area network if the MAC address is associated with the VPN; and
blocking the data traffic from transfer to the local area network if the MAC address is not associated with the VPN.
2. The method of claim 1 wherein determining if the MAC address is associated with the VPN comprises checking the MAC address against an access control list, wherein the access control list identifies the VPN and a group of MAC addresses associated with the VPN.
3. The method of claim 2 wherein the MAC address is associated with the VPN if the MAC address is in the group of MAC addresses associated with the VPN.
4. The method of claim 2 further comprising allowing an operator of the local area network to modify the access control list.
5. The method of claim 1 wherein the data traffic identifies an originating network and wherein the method further comprises if the MAC address is not allowed then providing a notification to the originating network identifying the MAC address.
6. An access interface system to interface between a local area network and a service provider network, the access interface system comprising:
a communication interface configured to receive data traffic transmitted from an originating device over a virtual private network (VPN), wherein the data traffic contains a media access control (MAC) address of a device along a path between the access interface system and the originating device; and
a processing system comprising circuitry configured to determine if the MAC address is associated with the VPN, and if the MAC address is associated with the VPN, direct the communication interface to transmit the data traffic to the local area network, and if the MAC address is not associated with the VPN, direct the communication interface to block the data traffic from transfer to the local area network.
7. The access interface system of claim 6 wherein the processing system configured to determine if the MAC address is associated with the VPN comprises the processing system configured to check the MAC address against an access control list, wherein the access control list identifies the VPN and a group of MAC addresses associated with the VPN.
8. The access interface system of claim 7 wherein the MAC address is associated with the VPN if the MAC address is in the group of MAC addresses associated with the VPN.
9. The access interface system of claim 7 further comprising the processing system configured to allow an operator of the local area network to modify the access control list.
10. The access interface system of claim 6 wherein the data traffic identifies an originating network and wherein if the MAC address is not allowed then the processing system is configured to provide a notification to the originating network identifying the MAC address.
11. A communication system comprising:
a first node coupled to a first network and configured to transfer data traffic for delivery to a second network over a virtual private network (VPN) link provided through a service provider network;
an access interface system configured to receive the data traffic from the service provider network over the VPN link, wherein the data traffic contains a media access control (MAC) address of a device along a path between the access interface system and the first node;
the access interface system configured to process the MAC address to determine if the data traffic is associated with the VPN link; and
the access interface system configured to transfer the data traffic to the second network if the data traffic is associated with the VPN link, and block the data traffic from transfer to the second network if the MAC address is not associated with the VPN link.
12. The communication system of claim 11 wherein the access interface system configured to process the MAC address to determine if the data traffic is associated with the VPN link comprises the access interface system configured to check the MAC address against an access control list, wherein the access control list identifies the VPN and a group of MAC addresses associated with the VPN.
13. The communication system of claim 12 wherein the MAC address is associated with the VPN if the MAC address is in the group of MAC addresses associated with the VPN.
14. The communication system of claim 12 further comprising allowing an operator of the local area network to modify the access control list.
15. The communication system of claim 11 wherein the data traffic identifies an originating network and wherein if the MAC address is not allowed then the access interface system is configured to provide a notification to the originating network identifying the MAC address.