Methods, modems, and systems for blocking data transfers unless including predefined communications to provide access to a network

Abstract

The transfer of data through a modem can be blocked in the modem during a safe mode unless the data includes predefined communications such as a request for a network address to maintain access to the network for the host system or a response to the request that includes the network address. Accordingly, the safe mode can protect a host system from unauthorized access from the network, while allowing the network service to be maintained for the host system. In particular, requests for renewals of leases, such as Dynamic Host Configuration Protocol (DHCP) requests and responses thereto, on Internet Protocol (IP) addresses used by the host system may not be blocked by the modem during safe mode. Furthermore, requests and response for addresses of systems on the network to which the DHCP requests are transmitted, such as Address Resolution Protocol (ARP) requests and responses thereto, may also not be blocked during safe mode. Moreover, in some embodiments according to the present invention, the blocking is provided at the modem so that multiple host systems can be protected by the modem. Related methods, modems, and systems are disclosed.

What is claimed:  
     
         1 . A method for providing a host system access to a network through a modem, the method comprising: 
 blocking transfer of data in a modem during a safe mode of operation of the modem unless the data transfer includes predefined communications.    
     
     
         2 . The method of  claim 1  wherein the predefined communications comprise network access maintenance information.  
     
     
         3 . The method of  claim 1  wherein the predefined communications comprise a request for a network address to maintain access to the network for the host system or a response to the request that includes the network address.  
     
     
         4 . The method of  claim 1  further comprising: 
 allowing the transfer of data other than the predefined communications through the modem during a normal mode of operation of the modem.  
 
     
     
         5 . The method of  claim 3  wherein the request is received from the host system and the response to the request is received from the network.  
     
     
         6 . The method of  claim 3  wherein the blocking transfer of data in a modem during a safe mode of operation of the modem unless the data transfer includes predefined communications comprises: 
 blocking transfer of the data from the host system to the network unless it is determined that the request comprises an Address Resolution Protocol (ARP) request for a MAC address of a system on the network that uniquely identifies the ARP request as originating from the host system; and  
 blocking transfer of the data from the network to the host system unless it is determined that the response comprises an ARP response that includes the MAC address requested by the ARP request.  
 
     
     
         7 . The method of  claim 3  wherein the blocking transfer of data in a modem during a safe mode of operation of the modem unless the data transfer includes predefined communications comprises: 
 determining if data received at the modem from the host system comprises an Address Resolution Protocol (ARP) request for a MAC address of a system on the network that uniquely identifies the ARP request as originating from the host system;  
 associating the MAC address with the ARP request in the modem and transmitting the ARP request including the MAC address from the modem to the network upon determining that the request comprises the ARP request;  
 determining if data received from the network at the modem comprises an ARP response including the MAC address associated with the ARP request; and  
 transmitting the data received from the network to the host system upon determining that the data received from the network comprises the ARP response including the MAC address associated with the ARP request.  
 
     
     
         8 . The method of  claim 7  further comprising: 
 disassociating the MAC address with the ARP request in the modem after transmitting the data received from the network to the host system.  
 
     
     
         9 . The method of  claim 7  wherein the data received from the network at the modem comprises first data and wherein the ARP response comprises a first ARP response, the method further comprising: 
 blocking second data received from the network at the modem after the first data is received upon determining that the second data comprises a second ARP response including the MAC address associated with the first ARP request.  
 
     
     
         10 . The method of  claim 7  further comprising: 
 disassociating the MAC address with the ARP request in the modem upon determining that the ARP response including the MAC address associated with the ARP request has not been received from the network within a time-out interval.  
 
     
     
         11 . The method of  claim 10  wherein the ARP request comprises a first ARP request, the method further comprising: 
 disassociating the MAC address with the first ARP request in the modem upon receiving a second ARP request from the host system; and  
 blocking data received from the network at the modem upon determining that the data received from the network comprises the first ARP response including the MAC address associated with the first ARP request.  
 
     
     
         12 . The method of  claim 3  wherein the blocking transfer of data in a modem during a safe mode of operation of the modem unless the data transfer includes predefined communications comprises: 
 blocking transfer of the data from the host system to the network unless it is determined that the request comprises an Dynamic Host Control Protocol (DHCP) request for an Internet Protocol (IP) address for the host system including a Transaction Identifier (XID) that uniquely identifies the DHCP request as originating from the host system; and  
 blocking transfer of the data from the network to the host system unless it is determined that the response comprises an DHCP response that includes the XID associated with the DHCP request.  
 
     
     
         13 . The method of  claim 3  wherein the blocking transfer of data in a modem during a safe mode of operation of the modem unless the data transfer includes predefined communications comprises: 
 determining if data received at the modem from the host system comprises a Dynamic Host Control Protocol (DHCP) request for an Internet Protocol (IP) address for the host system including a Transaction Identifier (XID) that uniquely identifies the DHCP request as originating from the host system;  
 associating the XID with the DHCP request in the modem and transmitting the DHCP request including the XID from the modem to the network upon determining that the request comprises the DHCP request;  
 determining if data received from the network at the modem comprises a DHCP response including the XID associated with the DHCP request; and  
 transmitting the data received from the network to the host system upon determining that the data received from the network comprises the DHCP response including the XID associated with the DHCP request.  
 
     
     
         14 . The method of  claim 13  further comprising: 
 disassociating the XID with the DHCP request in the modem after transmitting the data received from the network to the host system.  
 
     
     
         15 . The method of  claim 13  wherein the XID is generated by the host system.  
     
     
         16 . The method of  claim 13  wherein the data received from the network at the modem comprises first data and wherein the DHCP response comprises a first DHCP response, the method further comprising: 
 blocking second data received from the network at the modem after the first data is received upon determining that the second data comprises a second DHCP response including the XID associated with the first DHCP request.  
 
     
     
         17 . The method of  claim 13  further comprising: 
 disassociating the XID with the DHCP request in the modem upon determining that no data received from the network comprises the DHCP response including the XID associated with the DHCP request within a time-out interval.  
 
     
     
         18 . The method of  claim 17  wherein the DHCP request comprises a first DHCP request, the method further comprising: 
 disassociating the XID with the first DHCP request in the modem upon receiving a second DHCP request from the host system; and  
 blocking data received from the network at the modem upon determining that the data received from the network comprises the first DHCP response including the XID associated with the first DHCP request.  
 
     
     
         19 . The method of  claim 1  further comprising: 
 receiving input to the modem; and  
 ceasing blocking transfer of data in the modem in response to the input.  
 
     
     
         20 . The method of  claim 19  wherein receiving input to the modem comprises at least one of clicking on a Graphical User Interface and pushing a safe mode button on the modem.  
     
     
         21 . The method of  claim 1  wherein the host system comprises a first host system, the method further comprising: 
 allowing transfer of data associated with a second host system during a normal mode of operation of the modem associated with the second host system.  
 
     
     
         22 . The method of  claim 1  further comprising: 
 receiving input to the modem;  
 changing at least one of operation of a firewall associated with the modem and the safe mode in response to the input.  
 
     
     
         23 . A modem that transfers data between a network and a host system, the modem comprising: 
 a processor circuit in the modem that is configured to block the transfer of data through the modem during a safe mode of operation of the modem unless the data includes predefined communications.    
     
     
         24 . The modem of  claim 23  wherein the predefined communications comprise network access maintenance information.  
     
     
         25 . The modem of  claim 23  wherein the predefined communications comprise a request for a network address to maintain access to the network for the host system or a response to the request that includes the network address.  
     
     
         26 . The modem of  claim 23  wherein the processor circuit is further configured to allow the transfer of data other than the predefined communications through the modem during a normal mode of operation of the modem.  
     
     
         27 . The modem of  claim 25  wherein the request is received from the host system and the response to the request is received from the network.  
     
     
         28 . The modem of  claim 25  wherein the processor circuit is further configured to block transfer of the data transfer from the host system to the network unless it is determined that the request comprises an Address Resolution Protocol (ARP) request for a MAC address of a system on the network that uniquely identifies the ARP request as originating from the host system and to block transfer of the data from the network to the host system unless it is determined that the response comprises an ARP response that includes the MAC address requested by the ARP request.  
     
     
         29 . The modem of  claim 25  wherein the processor circuit is further configured to: 
 determine if data received at the modem from the host system comprises an Address Resolution Protocol (ARP) request for a MAC address of a system on the network that uniquely identifies the ARP request as originating from the host system;  
 associate the MAC address with the ARP request in the modem and transmitting the ARP request including the MAC address from the modem to the network upon determining that the request comprises the ARP request;  
 determine if data received from the network at the modem comprises an ARP response including the MAC address associated with the ARP request; and  
 transmit the data received from the network to the host system upon determining that the data received from the network comprises the ARP response including the MAC address associated with the ARP request.  
 
     
     
         30 . The modem of  claim 25  wherein the processor circuit is further configured to: 
 block transfer of the data from the host system to the network unless it is determined that the request comprises an Dynamic Host Control Protocol (DHCP) request for an Internet Protocol (IP) address for the host system including a Transaction Identifier (XID) that uniquely identifies the DHCP request as originating from the host system; and  
 block transfer of the data from the network to the host system unless it is determined that the response comprises an DHCP response that includes the XID associated with the DHCP request.  
 
     
     
         31 . The modem of  claim 25  wherein the processor circuit is further configured to: 
 determine if data received at the modem from the host system comprises a Dynamic Host Control Protocol (DHCP) request for an Internet Protocol (IP) address for the host system including a Transaction Identifier (XID) that uniquely identifies the DHCP request as originating from the host system;  
 associate the XID with the DHCP request in the modem and transmitting the DHCP request including the XID from the modem to the network upon determining that the request comprises the DHCP request;  
 determine if data received from the network at the modem comprises a DHCP response including the XID associated with the DHCP request; and  
 transmit the data received from the network to the host system upon determining that the data received from the network comprises the DHCP response including the XID associated with the DHCP request.  
 
     
     
         32 . A modem that transfers data between a network and a host system, the modem comprising: 
 means for blocking the transfer of data through a modem during a safe mode of operation of the modem unless the data includes predefined communications.    
     
     
         33 . The modem of  claim 32  wherein the predefined communications comprise network access maintenance information.  
     
     
         34 . The modem of  claim 32  wherein the predefined communications comprise a request for a network address to maintain access to the network for the host system or a response to the request that includes the network address.  
     
     
         35 . The modem of  claim 34  wherein the means for blocking comprises: 
 means for determining if data received at the modem from the host system comprises an Address Resolution Protocol (ARP) request for a MAC address of a system on the network that uniquely identifies the ARP request as originating from the host system;  
 means for associating the MAC address with the ARP request in the modem and transmitting the ARP request including the MAC address from the modem to the network upon determining that the request comprises the ARP request;  
 means for determining if data received from the network at the modem comprises an ARP response including the MAC address associated with the ARP request;  
 means for transmitting the data received from the network to the host system upon determining that the data received from the network comprises the ARP response including the MAC address associated with the ARP request.  
 
     
     
         36 . The modem of  claim 34  wherein the means for blocking comprises: 
 means for determining if data received at the modem from the host system comprises a Dynamic Host Control Protocol (DHCP) request for an Internet Protocol (IP) address for the host system including a Transaction Identifier (XID) that uniquely identifies the DHCP request as originating from the host system;  
 means for associating the XID with the DHCP request in the modem and transmitting the DHCP request including the XID from the modem to the network upon determining that the request comprises the DHCP request;  
 means for determining if data received from the network at the modem comprises a DHCP response including the XID associated with the DHCP request; and  
 means for transmitting the data received from the network to the host system upon determining that the data received from the network comprises the DHCP response including the XID associated with the DHCP request.