Ip-closed circuit system and method

Abstract

The invention relates to a switching module for creating, and operating secure networks of data sources and monitoring stations, and for providing controlled access to the data sources and monitoring stations from public networks.

What is claimed is: 
     
         1 - 25 . (canceled) 
     
     
         26 . A method of provisioning a secure network, the method comprising the steps of:
 associating with a port of a switching module a port-specific Internet protocol address (IP address) for allocation to a device to be connected to the switching module via that port, the device also being allocated a non-port-specific IP address;   routing a frame received at the port through the switching module to a destination device only if a condition is satisfied and otherwise rejecting the received frame as a spoofed frame, satisfying the condition comprising determining if a source IP address included in the frame is same as the port-specific IP address associated with the port.   
     
     
         27 . The method of  claim 26 , wherein:
 the port-specific IP address is generated using zeroconf; and   the non-port-specific IP address is generated using one of fixed allocation and Dynamic Host Configuration Protocol (DHCP).   
     
     
         28 . The method of  claim 26 , wherein:
 the port-specific IP address is invisible to a general network; and   the non-port-specific IP address is visible to the general network, and the device is accessible via the non-port-specific IP address to another device in a general network.   
     
     
         29 . The method of  claim 26 , wherein:
 the device to be connected comprises an IP camera; and   the destination device comprises at least one of a monitoring station and a recording device that is in electrical communication with the switching module and accessible to another device in a general network via the switching module.   
     
     
         30 . The method of  claim 26 , wherein the device to be connected comprises an access control endpoint. 
     
     
         31 . The method of  claim 26 , further comprising:
 establishing electrical communication via the port between the device to be connected and the switching module; and   storing at the port a unique address associated with the device,   wherein satisfying the condition further comprises determining if a device address included in the frame is same as the unique address stored at the port.   
     
     
         32 . The method of  claim 31 , wherein the unique address comprises a Media Access Control address (MAC address). 
     
     
         33 . The method of  claim 26 , further comprising:
 designating a key to the device and storing the key within the device,   wherein satisfying the condition further comprises determining if a value corresponding to the key included in the frame is same as the value corresponding to the designated key.   
     
     
         34 . The method of  claim 33 , wherein the key is selected from the group consisting of a hash of a MAC address of the device and a number of data frames transmitted by the device during a specified period. 
     
     
         35 . A secure network system, comprising a switching module comprising:
 a control unit for associating with a port of the switching module a port-specific Internet protocol address (IP address) for allocation to a device to be connected to the switching module via that port, the device also being allocated a non-port-specific IP address; and   a port configured for routing a frame received at the port through the switching module to a destination device only if a condition is satisfied and otherwise rejecting the received frame as a spoofed frame, wherein to determine if the condition is satisfied, the switching module is configured for determining if a source IP address included in the frame is same as the port-specific IP address associated with the port.   
     
     
         36 . The secure network system of  claim 35 , wherein:
 the port-specific IP address is generated using zeroconf and is invisible to a general network; and   the non-port-specific IP address is generated using one of fixed allocation and Dynamic Host Configuration Protocol (DHCP) and is visible to the general network, the device being accessible via the non-port-specific IP address to another device in a general network.   
     
     
         37 . The secure network system of  claim 35 , wherein:
 the device to be connected comprises an IP camera; and   the destination device comprises at least one of a monitoring station and a recording device that is in electrical communication with the switching module and accessible to another device in a general network via the switching module.   
     
     
         38 . The secure network system of  claim 35 , wherein the device to be connected comprises an access control endpoint. 
     
     
         39 . The secure network system of  claim 35 , wherein:
 the port is in electrical communication with the device to be connected; and   the switching module is configured for storing at the port a unique address associated with the device,   wherein to determine if the condition is satisfied the switching module is further configured for determining if a device address included in the frame is same as the unique address stored at the port.   
     
     
         40 . The secure network system of  claim 35 , wherein the switching module is further configured for:
 designating a key to the device and storing the key at the device,   wherein to determine if the condition is satisfied the switching module is further configured for determining if a value corresponding to the key included in the frame is same as the value corresponding to the designated key.   
     
     
         41 . The secure network system of  claim 35 , wherein the key is selected from the group consisting of a hash of a Media Access Control (MAC) address of the device and a number of data frames transmitted by the device during a specified period.