SNMP packet filtering for printing devices

Abstract

The present invention is directed to a system and method for filtering packets for a printing device. An IP address filter resides within an SNMP agent and acts to filter incoming SNMP packets, thereby restricting the visibility of the printing device to a small select group of users. An administrator determines the range of IP addresses to either allow access or reject. The filter comprises a reference IP address, within the range of administrator selected addresses and assigns an action corresponding to the selected addresses. The action may be either allowing the SNMP packet to be processed, or rejecting the SNMP packet and dropping the packet without replying to the sending address. To determine if the incoming packet source address matches the reference address, a 32-bit mask is also included within the filter.

1 . A method for an administrator to restrict access to a device parameter over a distributed computer system, the steps comprising: 
 specifying an address range associated with a data packet;    generating at least one filter corresponding to the specified address range, wherein the filter includes, 
 a reference address,  
 an address mask, and  
 an instruction representative of a desired action to be taken for a correlating address;  
   receiving an incoming packet;    comparing a source address of the incoming packet to the reference address to determine a correlating address; and    executing the instruction representative of the desired action in accordance with the source address of the incoming packet.    
   
   
       2 . The method of  claim 1 , the comparing step further comprising: 
 performing a bitwise AND operation between the source address and the address mask;    performing a bitwise AND operation between the reference address and the address mask; and    comparing the outcomes of the bitwise AND operations, wherein equal outcomes results in the correlating address, and wherein not equal outcomes results in an address outside the specified range.    
   
   
       3 . The method of  claim 1 , wherein the desired action includes an instruction to block the incoming packet.  
   
   
       4 . The method of  claim 3 , further comprising the step of dropping the incoming packet with a source address inside the specified address range.  
   
   
       5 . The method of  claim 3 , further comprising the step of allowing the incoming packet with a source address outside the specified address range.  
   
   
       6 . The method of  claim 5 , further comprising the step of processing the incoming packet with the source address outside the specified address range.  
   
   
       7 . The method of  claim 1 , wherein the desired action includes an instruction to allow the incoming packet.  
   
   
       8 . The method of  claim 7 , further comprising the step of processing the incoming packet.  
   
   
       9 . The method of  claim 7 , further comprising the step of blocking the incoming packet with a source address outside the specified address range.  
   
   
       10 . The method of  claim 9 , further comprising the step of dropping the incoming packet with the source address outside the specified address range.  
   
   
       11 . The method of  claim 1 , wherein the filter is incorporated inside an SNMP agent.  
   
   
       12 . The method of  claim 1 , wherein the source address and the reference address are an Internet Protocol address.  
   
   
       13 . A system for an administrator to restrict access to a device parameter over a distributed computer system, comprising: 
 means adapted for specifying an address range associated with a data packet;    means adapted for generating at least one filter corresponding to the specified address range, wherein the filter includes, 
 a reference address,  
 an address mask, and  
 an instruction representative of a desired action to be taken for a correlating address;  
   means adapted for receiving an incoming packet;    means adapted for comparing a source address of the incoming packet to the reference address to determine a correlating address; and    means adapted for executing the instruction representative of the desired action in accordance with the source address of the incoming packet.    
   
   
       14 . The system of  claim 13 , the comparing step further comprising: 
 means adapted for performing a bitwise AND operation between the source address and the address mask;    means adapted for performing a bitwise AND operation between the reference address and the address mask; and    means adapted for comparing the outcomes of the bitwise AND operations, wherein equal outcomes results in the correlating address, and wherein not equal outcomes results in an address outside the specified range.    
   
   
       15 . The system of  claim 13 , wherein the desired action includes an instruction to block the incoming packet.  
   
   
       16 . The system of  claim 15 , further comprising means adapted for dropping the incoming packet with a source address inside the specified address range.  
   
   
       17 . The system of  claim 15 , further comprising means adapted for allowing the incoming packet with a source address outside the specified address range.  
   
   
       18 . The system of  claim 17 , further comprising means adapted for processing the incoming packet with the source address outside the specified address range.  
   
   
       19 . The system of  claim 13 , wherein the desired action includes an instruction to allow the incoming packet.  
   
   
       20 . The system of  claim 19 , further comprising means adapted for processing the incoming packet.  
   
   
       21 . The system of  claim 19 , further comprising means adapted for blocking the incoming packet with a source address outside the specified address range.  
   
   
       22 . The system of  claim 21 , further comprising means adapted for dropping the incoming packet with the source address outside the specified address range.  
   
   
       23 . The system of  claim 13 , wherein the filter is incorporated inside an SNMP agent.  
   
   
       24 . The system of  claim 13 , wherein the source address and the reference address are an Internet Protocol address.