SYSTEM AND METHOD FOR SOURCE IP ANTI-SPOOFING SECURITY

• US 20090254973A1
• Filed: 02/25/2009
• Published: 10/08/2009
• Est. Priority Date: 05/21/2003
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Foundry Networks Incorporated (Broadcom, Inc.)
• Inventors: Kwan, Philip
• Granted Patent: US 7,979,903 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A system and method that provides for using source IP addresses and MAC addresses in a network to provide security against attempts by users of the network to use false source IP addresses in data packets. The system and method provide for analyzing MAC addresses and source IP addresses at the datalink (layer 2) level, and to use the information derived from such analysis to block access through a port where a host device is using a false, or spoofed, source IP address in transmitted data packets.

Claims

1-21. -21. (canceled)

22. A method comprising:

determining, by a network device, whether a source IP address included in a data packet received on a port of the network device is stored in a table of the network device; and

if the source IP address is not stored in the table;

determining, by the network device, whether a number of source IP addresses stored in the table for the port equals or exceeds a maximum number of source IP addresses predetermined for the port; and

if the number of source IP addresses stored in the table for the port does not equal or exceed the maximum number;

learning, by the network device, the source IP address; and

storing, by the network device, the source IP address in the table.

23. The method of claim 22 further comprising using the table to control transmission of data packets through one or more ports of the network device.

24. The method of claim 22 further comprising, if the source IP address is stored in the table, allowing the data packet to pass though the port.

25. The method of claim 22 further comprising, if the number of source IP addresses stored in the table for the port equals or exceeds the maximum number, preventing the data packet from passing through the port.

26. The method of claim 22 wherein learning the source IP address comprises:

generating a reverse Address Resolution Protocol (ARP) message based on a MAC address included in the data packet; and

determining whether a source IP address included in a response to the reverse ARP message matches the source IP address included in the data packet.

27. The method of claim 26 further comprising confirming that the learned source IP address is correct by performing a reverse IP check.

28. The method of claim 22 further comprising, subsequently to storing the source IP address in the table, removing the source IP address from the table after a predetermined time interval.

29. The method of claim 22 wherein the table is configured to store a plurality of MAC address and source IP address pairs.

30. The method of claim 22 wherein the table is stored in a Content Addressable Memory (CAM) device of the network device.

31. A method comprising:

determining, by a network device, whether a source IP address included in a data packet received on a port of the network device is stored in a table of the network device; and

if the source IP address is not stored in the table;

determining, by the network device, whether a number of source IP addresses stored in the table for the port equals or exceeds a maximum number of source IP addresses predetermined for the port; and

if the number of source IP addresses stored in the table for the port does not equal or exceed the maximum number;

determining, by the network device, whether a MAC address included in the data packet is stored in the table; and

if the MAC address is not stored in the table;

learning, by the network device, the source IP address; and

storing, by the network device, the MAC address and the source IP address in the table.

32. The method of claim 31 further comprising, if the MAC address and source IP address are stored in the table, allowing the data packet to pass through the port.

33. The method of claim 31 further comprising, if the MAC address is not stored in the table or if the source IP address is not stored in the table, preventing the data packet from passing through the port.

34. A network device comprising:

a plurality of ports;

a storage component configured to store a table of source IP addresses; and

a control component configured to;

determine whether a source IP address included in a data packet received on a port in the plurality of ports is stored in the table; and

if the source IP address is not stored in the table;

determine whether a number of source IP addresses stored in the table for the port equals or exceeds a maximum number of source IP addresses predetermined for the port; and

if the number of source IP addresses stored in the table for the port does not equal or exceed the maximum number;

learn the source IP address; and

store the source IP address in the table.

35. The network device of claim 34 wherein the control component is further configured to use the table to control transmission of data packets through the port.

36. The network device of claim 34 wherein the control component is further configured to prevent the data packet from passing through the port if the number of source IP addresses stored in the table for the port equals or exceeds the maximum number.

37. The network device of claim 34 wherein learning the source IP address comprises:

generating a reverse Address Resolution Protocol (ARP) message based on a MAC address included in the data packet; and

determining whether a source IP address included in a response to the reverse ARP message matches the source IP address included in the data packet.

38. The network device of claim 37 wherein the control component is further configured to confirm that the learned source IP address is correct by performing a reverse IP check.

39. The network device of claim 34 wherein the control component is further configured to, subsequently to storing the source IP address in the table, remove the source IP address from the table after a predetermined time interval.

40. The network device of claim 34 wherein the storage component is a Content Addressable Memory (CAM) device.

41. A network device comprising:

a plurality of ports;

a storage component configured to store a table of MAC address and source IP address pairs; and

a control component configured to;

determine whether a source IP address included in a data packet received on a port in the plurality of ports is stored in the table; and

if the source IP address is not stored in the table;

determine whether a number of source IP addresses stored in the table for the port equals or exceeds a maximum number of source IP addresses predetermined for the port; and

if the number of source IP addresses stored in the table for the port does not equal or exceed the maximum number;

determine whether a MAC address included in the data packet is stored in the table; and

if the MAC address is not stored in the table;

 

learn the source IP address; and

 

store the MAC address and the source IP address in the table.