User based stateless IPv6 RA-guard
View Patent ↗The present disclosure relates to an apparatus, a method, and a non-transitory computer readable storage medium for filtering routing assignment (RA) messages in a computer network. Methods, non-transitory computer readable storage medium, and apparatus consistent with the present disclosure may receive an RA message, extract information included in an RA message when identifying whether that particular RA messages should be forwarded or blocked. Information used to identify when to forward or block particular RA messages may be related to information that identifies a user of a computer or that identifies a computer that sends RA messages over a computer network.
1. A method for filtering routing assignment (RA) messages in a computer network, the method comprising:
receiving login information from a computing device via an interface in a protected computer network, the computing device associated with a user;
authenticating the computing device based on the received login information, wherein a record is stored that identifies the computing device as authenticated;
receiving a first RA message over the protected computer network interface of one or more computer interfaces;
extracting information from the first RA message;
identifying that the extracted information from the first RA message corresponds to a stored record;
identifying that information in the stored record corresponds to at least one of the computing device or the user, wherein the computing device is a personal device associated with the user communicating over the protected computer network interface;
identifying that the information in the stored record is associated with an allowed source of RA messages based on the at least one of the computing device or the user being the allowed source of RA messages;
and
forwarding the first RA message to at least another computing device at the protected network based on the identification that the first RA message is associated with the allowed source of RA messages.
2. The method of claim 1 , further comprising:
receiving a second RA message over the protected computer network interface or another computer network interface of the one or more computer network interfaces;
extracting information from the second RA message;
identifying that the extracted information from the second RA message corresponds to a second stored record;
identifying that information in the second stored record corresponds to at least one of a second computing device or second user;
identifying that RA messages from the at least the second computing device or from a computing device associated with the second user are not allowed to be forwarded to other computers at the protected computer network; and
blocking the second RA message, wherein the blocking of the second RA message includes not forwarding the second RA message.
3. The method of claim 1 , wherein the identifying that the extracted information in the second RA message corresponds to the stored record is identified by comparing the extracted information with information included in the stored record.
4. The method of claim 3 , wherein the information included in the stored record identifies at least one of a device user identifier (ID), a device machine identifier, a device Internet protocol (IP) address, and a timestamp.
5. The method of claim 1 , wherein the information associated with the user identifies the user and identifies that RA messages associated with the user are allowed to be forwarded to the another computing device at the protected computer network.
6. The method of claim 1 , wherein the authentication of the computing device includes verifying user credentials of the user before receiving the first RA message.
7. The method of claim 1 , wherein the authentication of the computing device includes receiving a username and a password of the user.
8. The method of claim 6 , further comprising storing information that identifies a time period over which RA messages associated with the user will be allowed, wherein the time period begins at the time when the user credentials are verified.
9. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor to perform a method for filtering routing assignment (RA) messages in a computer network, the method comprising:
receiving login information from a computing device via an interface in a protected computer network, the computing device associated with a user;
authenticating the computing device based on the received login information, wherein a record is stored that identifies the computing device as authenticated;
receiving a first RA message over the computer network interface of one or more computer interfaces;
extracting information from the first RA message;
identifying that the extracted information from the first RA message corresponds to a stored record;
identifying that information in the stored record corresponds to at least one of the computing device or the user, wherein the computing device is a personal device associated with the user communicating over the protected computer network interface;
identifying that the information in the stored record is associated with an allowed source of RA messages based on the at least one of the computing device or the user being the allowed source of RA messages;
and
forwarding the first RA message to at least another computing device at the protected network based on the identification that the first RA message is associated with the allowed source of RA messages.
10. The non-transitory computer-readable storage medium of claim 9 , the program further executable to:
receive a second RA message over the protected computer network interface or another computer network interface of the one or more computer network interfaces;
extract information from the second RA message;
identify that the extracted information from the second RA message corresponds to a second stored record;
identifying that information in the second stored record corresponds to at least one of a second computing device or second user;
identifying that RA messages from the at least the second computing device or from a computing device associated with the second user are not allowed to be forwarded to other computers at the protected computer network; and
block the second RA message, wherein the blocking of the second RA message includes not forwarding the second RA message.
11. The non-transitory computer-readable storage medium of claim 9 , wherein the identifying that the extracted information in the second RA message corresponds to the stored record is identified by comparing the extracted information with information included in the stored record.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the information included in the stored record identifies at least one of a device user identifier (ID), a device machine identifier, a device internet protocol (IP) address, and a timestamp.
13. The non-transitory computer-readable storage medium of claim 9 , wherein the information associated with the user identifies the user and identifies that RA messages associated with the user are allowed to be forwarded to the another computing device at the protected computer network.
14. The non-transitory computer-readable storage medium of claim 9 , wherein the authentication of the computing device includes verifying user credentials of the user before receiving the first RA message.
15. The non-transitory computer-readable storage medium of claim 9 , wherein the authentication of the computing device includes receiving a username and a password of the user.
16. The non-transitory computer-readable storage medium of claim 9 , the program further executable to store information that identifies a time period over which RA messages associated with the user will be allowed, wherein the time period begins at the time when the user credentials are verified.
17. An apparatus for filtering routing assignment (RA) messages in a computer network, the apparatus comprising:
one or more network communication interfaces at a protected computer network, wherein login information is received from a computing device via a protected computer network interface of the one or more network communication interfaces,
a memory; and
a processor that executes instructions out of the memory to authenticate the computing device based on the received login information, wherein:
a record is stored that identifies the computing device as being authenticated,
a first RA message is received over the protected computer network interface, and
the processor further executes instructions out of the memory to:
extract information from the first RA message,
identify that the extracted information from the first RA message corresponds to a stored record,
identify that information in the stored record corresponds to at least one of the computing device or a user, wherein the computing device is a personal device associated with the user communicating over the protected computer network interface;
identify that the information in the stored record is associated with an allowed source of RA messages based on the at least one of the computing device or the user being the allowed source of RA messages,
and
forward the first RA message to at least another computing device at the protected computer network based on the identification that the first RA message is associated with the allowed source of RA messages.
18. The apparatus of claim 17 , wherein:
the network interface or another network interface of the one or more network interfaces receives a second RA message and the processor executing instructions out of the memory:
extracts information from the second RA message;
identifies that the extracted information from the second RA message corresponds to a second stored record;
identifies that information in the second stored record corresponds to at least one of a second computing device or second user;
identifies that RA messages from the at least second computing device or from a computing device associated with the second user are not allowed to be forwarded to the another computing device at the protected computer network; and
blocks the second RA message, wherein the blocking of the second RA message includes not forwarding the second RA message.
19. The apparatus of claim 17 , wherein the identifying that the extracted information in the second RA message corresponds to the stored record is identified by comparing the extracted information with information included in the stored record.
20. The apparatus of claim 19 , wherein the information included in the stored record identifies at least one of a device user identifier (ID), a device machine identifier, a device internet protocol (IP) address, and a timestamp.