Method and apparatus for assignment of IP addresses

• US 6,073,178 A
• Filed: 12/09/1996
• Issued: 06/06/2000
• Est. Priority Date: 12/09/1996
• Status: Expired due to Term

• Current Assignee: Motorola, Inc. (Motorola Solutions, Inc.), Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.), Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Patrick, Michael W., Goedman, Robert J., Wong, Thomas K., Lim, Swee B., Tsirigotis, Panagiotis, Radia, Sanjay R.
• Primary Examiner(s): Maung, Zarni
• Assistant Examiner(s): YUAN, ALMARI ROMERO
• Application Number:
  US08/762,709
• Time in Patent Office: 1,275 Days
• Field of Search: 709/229, 709/240, 709/242, 709/245, 709/238, 709/239, 370/485, 370/486, 370/474, 370/475
• US Class Current: 709/229
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A preferred embodiment of the present invention includes a method and apparatus for allocating and using IP addresses in a network of client systems. More specifically, the present invention includes a router which monitors the assignments of IP addresses by a DHCP server. As each IP address is assigned, the router associates the assigned IP address with an trusted identifier which identifies the client system. Subsequently, if the router received a packet directed at the assigned IP address, the router forwards the packet to the client system having an trusted identifier associated with the destination address of the IP packet. Additionally, if the router receives a packet from a client system, it uses the trusted identifier of the client system to find IP addresses associated with the client system. If the source address of the IP packet is not included in the IP addresses associated with the client system, the packet is discarded.

Claims

1. A method for allocating and using IP addresses in a computer network that includes one or more client systems connected to a router, each client system having an associated trusted identifier, with the router system being able to send IP packets to an individual client system using the trusted identifier associated with the client system, the method comprising the steps, performed by the router, of:

detecting a request made by a client system for allocation of an IP address;

encoding the trusted identifier associated with the client system in the request;

detecting a response to the request from a Dynamic Host Configuration Protocol server, the response including an IP address allocated to the client system, the response including a copy of the trusted identifier encoded in the request;

associating the IP address included in the response with the client system trusted identifier included in the response; and

forwarding the response to the client system using the trusted identifier included in the response.

2. A method as recited in claim 1 further comprising the steps, performed by the router, of:

receiving an IP packet sent by one of the client systems;

using the trusted identifier of the sending client system to retrieve IP addresses associated with the sending client system;

retrieving a source IP address from the IP packet; and

conditionally discarding the IP packet if the source IP address is not included in the IP addresses associated with the sending client system.

3. A method as recited in claim 1 further comprising the steps, performed by the router, of:

receiving an IP packet being sent to one of the client systems;

retrieving a destination IP address from the IP packet;

using the destination IP address to retrieve the trusted identifier of the client system associated with the destination IP address; and

forwarding the IP packet to the client system using the retrieved trusted identifier.

4. A method as recited in claim 1 wherein the detected request made by a client system for allocation of an IP address is a DHCPDISCOVER message.

5. A method as recited in claim 4 wherein the step of encoding the trusted identifier associated with the client system, is performed by encoding the trusted identifier in the vendor-specific information of the DHCPDISCOVER message.

6. A method as recited in claim 1 wherein the detected response to the request from a Dynamic Host Configuration Protocol server is a DHCPACK message.

7. A method as recited in claim 1 wherein the router included in the computer network is a cable router and wherein the network includes one or more cable modems with each client system being connected to the to the cable router using one such cable modem and wherein the trusted identifier associated with each client is the modem id of the cable modem to which the client system is connected.

8. A computer program product comprising:

a computer usable medium having computer readable code embodied therein for allocating and using IP addresses in a computer network that includes one or more client systems, each client system having an associated trusted identifier, the computer program product comprising;

first computer readable program code devices configured to cause a computer system to detect a request made by a client system for allocation of an IP address;

second computer readable program code devices configured to cause the computer system to encode the trusted identifier associated with the trusted identifier in the request; and

third computer readable program code devices configured to cause the computer system to detect a response to the request from a Dynamic Host Configuration Protocol server, the response including an IP address allocated to the client system, the response including a copy of the trusted identifier encoded in the request;

fourth computer readable program code devices configured to cause the computer system to associate the IP address included in the response with the client system trusted identifier included in the response; and

fifth computer readable program code devices configured to cause the computer system to forward the response to the client system using the trusted identifier included in the response.

9. A computer program product as recited in claim 8 which further comprises:

sixth computer readable program code devices configured to cause the computer system to receive IP packets sent by the client systems, each IP packet including a source IP address;

seventh computer readable program code devices configured to cause the computer system to use the trusted identifier of each client system sending IP packets to retrieve IP addresses associated with each client system sending IP packets; and

eighth computer readable program code devices configured to cause the computer system to conditionally discard an IP packet if the source IP address included in the IP packet is not included in the IP addresses associated with the client system sending the IP packet.

10. A computer program product as recited in claim 8 which further comprises:

sixth computer readable program code devices configured to cause the computer system to receive IP packets sent to one of the client systems, each IP packet including a destination IP address;

seventh computer readable program code devices configured to cause the computer system to use the destination IP address of each received IP packet to retrieve the trusted identifier of the client system associated with the destination IP address; and

eighth computer readable program code devices configured to cause the computer system to forward the received IP packet to the client system associated with the destination IP address.

11. A computer program product as recited in claim 8 wherein the detected request made by a client system for allocation of an IP address is a DHCPDISCOVER message.

12. A computer program product as recited in claim 8 wherein the trusted identifier associated with the client system is encoded in the vendor-specific information of the DHCPDISCOVER message.

13. A computer program product as recited in claim 8 wherein the detected response to the request from a Dynamic Host Configuration Protocol server is a DHCPACK message.

14. An apparatus for allocating and using IP addresses in a computer network that includes one or more client systems connected to a router, each client system having an associated trusted identifier, with the router system being able to send IP packets to an individual client system using the trusted identifier associated with the client system, the method comprising the steps, performed by the router, of:

a first portion configured to cause the router to detect the assignment of an IP addresses to a client system and to associated the IP address assigned to a client system with the trusted identifier of the client system;

a second portion configured to cause the router to accept an IP packet directed at a client system, the accepted IP packet including a destination IP address, the second portion also configured to cause the router to use the destination IP address of the accepted IP packet to retrieve the trusted identifier of the client system associated with the destination IP address and to forward the accepted IP packet to the client system associated with the destination IP address; and

a third portion configured to cause the router to accept an IP packet sent from a client system, the accepted IP packet including a source IP address, the third portion also configured to cause the router to use the trusted identifier of the sending client system to retrieve IP addresses associated with the sending client system and to conditionally discard the accepted IP packet if the source IP address included in the accepted IP packet is not included in the IP addresses associated with the sending client system.