Network intrusion mitigation

Patent metadata

Field	Value
Publication number	US-10187402-B2
Application number	US-201514952479-A
Country	US
Kind code	B2
Filing date	Nov 25, 2015
Priority date	Nov 25, 2015
Publication date	Jan 22, 2019
Grant date	Jan 22, 2019

Abstract

A request is received to reestablish a connection to an end device in a network. At least one datum is identified indicating an error condition, the at least one datum including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet. Based on the one or more data values, user input is requested to deny the reestablish connection request. In response to the user input, the end device is prevented from reestablishing a link on the network.

First claim

What is claimed is:

1. A device that includes a processor and a memory, the memory storing instructions executable by the processor such that the device is programmed to:
receive a reestablish connection request via a first user input to terminate and then reestablish a connection to an end device in a network;
identify at least one error condition, the at least one error condition including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet;
provide a confirmation request for a second user input to deny the reestablish connection request, wherein the confirmation request for the second user input to deny the reestablish connection request is triggered by identifying the at least one error condition; and
in response to the second user input, prevent the end device from reestablishing a link on the network.

2. The device of claim 1 , wherein the network is a mesh network.

3. The device of claim 1 , wherein the device is further programmed to:
reestablish the connection between the device and the end device, based upon the second user input.

4. The device of claim 1 , wherein the device is further programmed to:
identify the BER by determining that a packet error rate for communications from the end device exceed a predetermined threshold.

5. The device of claim 4 , wherein the device is further programmed to:
start a BER timer; and
determine when the BER timer exceeds a predetermined BER timer threshold.

6. The device of claim 1 , wherein the device is further programmed to determine the RSSI value exceeds a predetermined threshold.

7. The device of claim 6 , wherein the device is further programmed to:
start a RSSI timer; and
determine when the RSSI timer exceeds a predetermined RSSI timer threshold.

8. The device of claim 1 , wherein the device is further programmed to:
identify the foreign packet by comparing an address of the foreign packet to a known address.

9. The device of claim 8 , wherein the device is further programmed to:
start a foreign packet counter; and
determine when the foreign packet counter exceeds a predetermined foreign packet counter threshold.

10. The device of claim 1 , wherein the device is a ZigBee coordinator.

11. A method comprising:
receiving a reestablish connection request via a first user input to terminate and then reestablish a connection to an end device in a network;
identifying at least one error condition, the at least one error condition including one or more of a bit error rate (BER), a received signal strength indicator (RSSI) value, and a foreign packet;
provide a confirmation request for a second user input to deny the reestablish connection request, wherein the confirmation request for the second user input to deny the reestablish connection request is triggered by identifying the at least one error condition; and
in response to the second user input, preventing the end device from reestablishing a link on the network.

12. The method of claim 11 , wherein the network is a mesh network.

13. The method of claim 11 , further comprising reestablishing the connection between the device and the end device, based upon the second user input.

14. The method of claim 11 , further comprising:
identify the BER by determining that a packet error rate for communications from the end device exceed a predetermined threshold.

15. The method of claim 14 , further comprising:
starting a BER timer; and
determining when the BER timer exceeds a predetermined BER timer threshold.

16. The method of claim 11 , further comprising determining the RSSI value exceeds a predetermined threshold.

17. The method of claim 11 , further comprising:
starting a RSSI timer; and
determining when the RSSI timer exceeds a predetermined RSSI timer threshold.

18. The method of claim 11 , further comprising:
identifying the foreign packet by comparing an address of the foreign packet to a known address.

19. The method of claim 11 , further comprising:
starting a foreign packet counter; and
determining when the foreign packet counter exceeds a predetermined foreign packet counter threshold.

Assignees

• Echostar Technologies Llc
• Echostar Tech International Corporation

Inventors

• Beals William Michael

Classifications

• H04W12/08

  Access security · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L69/40

  for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) · CPC title

• H04L67/141

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04W84/18

  Self-organising networks, e.g. ad-hoc networks or sensor networks · CPC title