Method and system for controlling access to shared devices
A non-transitory computer readable medium includes computer readable program code including instructions for snooping a message from a client device addressed to a particular IP address corresponding to a shared device; determining whether the client device has authorization to access the shared device; responsive to determining that the client device does not have authorization to access the shared device, refraining from forwarding the message to the particular IP address; and responsive to determining that the client device has authorization to access the shared device, forwarding the message to the particular IP address.
1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:
snooping, by a network device, a message sent from a client device and addressed to a particular IP address corresponding to a shared device while the message is being transmitted to the shared device, wherein the message is not addressed to the network device;
determining, by the network device, whether the client device is allowed to access the shared device based on the particular IP address;
responsive to determining that the client device is not allowed to access the shared device, refraining from forwarding the message to the particular IP address;
responsive to determining that the client device is allowed to access the shared device, forwarding the message to the particular IP address.
2. The medium of claim 1 , wherein refraining from forwarding the message to the particular IP address is further responsive to determining that the message comprises a request by the client device to open a connection with the shared device.
3. The medium of claim 1 , wherein the message comprises a Transmission Control Protocol (TCP) connection request.
4. The medium of claim 1 , wherein determining that the client device is not allowed to access the shared device comprises determining that the information corresponding to the shared device was not previously transmitted by the network device to the client device.
5. The medium of claim 1 , wherein determining that the client device is not allowed to access the shared device comprises determining that the particular IP address corresponding to the shared device was not previously transmitted by the network device to the client device.
6. The medium of claim 1 , wherein determining that the client device is allowed to access the shared device comprises determining that the information corresponding to the shared device was previously transmitted by the network device to the client device.
7. The medium of claim 1 , wherein determining whether the client device is allowed to access the shared device comprises checking whether the client device is listed in an access control list identifying devices that have access to the shared device.
8. The medium of claim 1 , wherein determining whether the client device is allowed to access the shared device comprises checking whether the shared device is listed in an access control list identifying devices that the client device is allowed to access.
9. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes the one or more hardware processors to:
snoop, by a network device, a message sent from a client device and addressed to a particular IP address corresponding to a shared device while the message is being transmitted to the shared device, wherein the message is not addressed to the network device;
determine that the message comprises a request for functionality of the shared device based on the particular IP address;
responsive at least to a determination that the message comprises a request for functionality of the shared device:
refrain from forwarding the message to the particular IP address.
10. The medium of claim 9 , wherein the instructions are further to cause the one or more hardware processors to refrain from forwarding the message to the particular IP address responsive to a determination that the client device is not allowed to access the shared device.
11. The medium of claim 10 , wherein the instructions are further to cause the one or more hardware processors to determine that the client device is not allowed to access the shared device in response to a determination that the information corresponding to the shared device was not previously transmitted by the network device to the client device.
12. The medium of claim 10 , wherein the instructions are further to cause the one or more hardware processors to determine that the client device is not allowed to access the shared device in response to a determination that the client device is not listed in an access control list identifying devices that have access to the shared device.
13. The medium of claim 9 , wherein the instructions are further to cause the one or more hardware processors to:
responsive at least to a determination that the message comprises a request for functionality of the shared device:
instruct the client device to terminate a connection with the shared device.
14. The medium of claim 9 , wherein the instructions are further to cause the one or more hardware processors to:
responsive at least to a determination that the message comprises a request for functionality of the shared device:
transmit a message to the client device that spoofs the shared device and terminates a connection between the shared device and the client device.
15. The medium of claim 9 , wherein the instructions are further to cause the one or more hardware processors to:
responsive at least to a determination that the message comprises a request for functionality of the shared device:
determine whether the client device is allowed to access the shared device;
responsive to a determination that the client device is allowed to access the shared device:
transmit information to the client device that identifies the functionality of the shared device.
16. The medium of claim 9 , wherein the instructions are further to cause the one or more hardware processors to determine that the message comprises a request for functionality of the shared device in response to a determination that the message comprises one or more strings corresponding to a request for functionality of the shared device.
17. A system comprising:
a network device including a hardware processor;
a memory on which is stored instructions that are to cause the hardware processor to:
snoop a message sent from a client device and addressed to a particular IP address corresponding to a shared device while the message is being transmitted to the shared device, wherein the message is not addressed to the network device;
determine whether the client device is allowed to access the shared device based on the particular IP address;
responsive to a determination that the client device is not allowed to access the shared device, refrain from forwarding the message to the particular IP address; and
responsive to a determination that the client device is allowed to access the shared device, forward the message to the particular IP address.
18. The system of claim 17 , wherein the instructions are further to cause the hardware processor to determine whether the message comprises a request by the client device to open a connection with the shared device, and to refrain from forwarding the message to the particular IP address in response to a determination that the message comprises a request by the client device to open a connection with the shared device.
19. The system of claim 17 , wherein the message comprises a Transmission Control Protocol (TCP) connection request.
20. The system of claim 17 , wherein to determine that the client device is not allowed to access the shared device, the instructions are further to cause the hardware processor to determine that the information corresponding to the shared device was not previously transmitted by the network device to the client device.
21. The system of claim 17 , wherein to determine that the client device is not allowed to access the shared device, the instructions are further to cause the hardware processor to determine that the particular IP address corresponding to the shared device was not previously transmitted by the network device to the client device.
22. The system of claim 17 , wherein to determine that the client device is allowed to access the shared device, the instructions are further to cause the hardware processor to determine that the information corresponding to the shared device was previously transmitted by the network device to the client device.
23. The system of claim 17 , wherein to determine whether the client device is allowed to access the shared device, the instructions are further to cause the hardware processor to check whether the client device is listed in an access control list identifying devices that have access to the shared device.