Method and arrangement for preventing illegitimate use of ip addresses

• US 20060155853A1
• Filed: 11/06/2002
• Published: 07/13/2006
• Est. Priority Date: 11/06/2002
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Nesz, Peter, Juhl, Michael Valentin, Johansson, Thomas
• Granted Patent: US 7,996,537 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields

Abstract

Illegitimate use of IP addresses is counteracted. A network (1) includes a switch (5) with ports (P1,P2,P3) to subscribers (6,6A) and a port (PN) to a core network (2) with DHCP servers (4, 4a,4b). The switch includes a database (MAC1, MAC2), port numbers (P1, P2) and VLAN identities (VLAN1, VLAN2) for the subscribers (6, 6A) and the filter has a list over trusted DHCP servers. Initially onlY DHCP messages from the subscribers are allowed. When the subscriber (6) requests (M1, M3) for an IP address it is checked that it is a DHCP message with valid subscriber values (MAC1, P1, VLAN1). A respond (M2, M4) with an allocated IP address (IP1) and lease time interval (T1) is checked to come from a trusted DHCP server. If so, a list in the filter (9) with correct information is dynamically generated (MAC1, P1, VLAN1, IP1, T1). A messsage (M5) from the subscriber (6) with false IP address is discarded by the filter. Attempts by the subscriber to use false IP address are counted and a warning signal is generated.

Claims

1-12. -12. (canceled)

13. A method in an IP network, the network including a switch node, at least one DHCP server and at least one subscriber being associated with the node, the method including the steps of:

creating a list of trusted ones of the DHCP servers;

transmitting by the subscriber a DHCP request message for an IP address;

receiving a reply message, which carries an assigned subscriber IP address;

analysing the reply message to be a DHCP message and having a source address from one of the trusted DHCP servers;

updating a filter dynamically in the node, the filter storing an identification of the subscriber and the assigned subscriber IP address;

transmitting a frame from the subscriber using a source IP address;

comparing in the filter said source IP address with the stored subscriber IP address;

discarding said frame when said source IP address differs from the stored subscriber IP address.

14. The method in an IP network according to claim 13, further comprising the step of storing in the filter a subscriber MAC address, a subscriber physical port number, a subscriber virtual LAN identity and a lease time interval for the assigned subscriber IP address.

15. The method in an IP network according to claim 13, wherein the subscriber IP address is statically assigned and handled by the DHCP servers.

16. The method in an IP network according to claim 14, the method including deleting the subscriber identification and the corresponding assigned subscriber IP address from the filter when the lease time interval is out.

17. The method in an IP network according to claim 13, the method further comprising the steps of:

counting a number of attempts (n) from the subscriber to use an illegitimate IP address;

comparing the number (n) of the attempts with a threshold number (N);

sending a warning signal when the number of attempts exceeds a threshold criteria.

18. A device in an IP network, the device including:

at least one port for a subscriber;

an uplink port for DHCP servers in the network; and

a filter device having a list of trusted ones of the DHCP servers, the filter device being associated with the ports;

wherein;

the device is operative to receive a subscriber IP address request message on the subscriber port, analyse it to be a DHCP message and transmit it on the uplink port;

the device is operative to receive a reply message on the uplink port, analyse it to be a DHCP message and to have a source IP address from one of the trusted DHCP servers on the list;

the device is operative to dynamically update the filter with an identification of the subscriber and a corresponding assigned subscriber IP address in the reply message;

the device is operative to receive a frame with a source IP address on the subscriber port;

the device is operative to compare in the filter said source IP address with the stored subscriber IP address; and

the device is operative to discard said frame when said source IP address differs from the stored subscriber IP address.

19. The device in an IP network according to claim 18, the device being further operative to store in the filter a subscriber MAC address, a subscriber physical port number, a subscriber virtual LAN identity and a lease time interval for the assigned subscriber IP address.

20. The device in an IP network according to claim 18, wherein the subscriber IP address comprises a statically assigned address which is handled by the DHCP servers.

21. The device in an IP network according to claim 19, the device being further operative to delete the subscriber identification and the corresponding assigned subscriber IP address from the filter when the lease time interval is out.

22. The device in an IP network according to claim 18, the filter having a counter operative to count a number (n) of discarded frames on the subscriber port, to compare the number (n) of the discarded frames with a threshold number (N) and to send a warning signal when the number of discarded frames exceeds a threshold criterion.