Methods and apparatus for protecting against IP address assignments based on a false MAC address

• US 7,320,070 B2
• Filed: 07/08/2003
• Issued: 01/15/2008
• Est. Priority Date: 01/08/2002
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Services Corporation (Verizon Communications Inc.)
• Inventors: Baum, Robert T.
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US10/616,405
• Publication Number:
  US 20040071164A1
• Time in Patent Office: 1,652 Days
• Field of Search: 726/13, 726/14, 713/153
• US Class Current: 713/153
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 45/742 Route cache; Operation thereof
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/4547 for personal communications, i.e. using a personal identifier
• CPC Class Codes: H04L 61/4557 Directories for hybrid networks, e.g. including telephone numbers
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Methods and apparatus detecting attempts to obtain IP addresses by faking a MAC address in a data portion of an IP address request message are described. In accordance with the present invention, rather than use standard address allocation protocols, e.g., ARP, the DNS DCHP contacts the requesting edge router via a private secure network. The MAC address received in the address request is compared to the MAC addresses stored in the edge routers port/MAC address resolution table. If the MAC address received in the request message cannot be found in the edge router'"'"'s table which was created from the MAC address included in the message'"'"'s header, a fraudulent attempt to obtain a MAC address is declared. The fraudulent attempt to obtain an IP address can be reported and steps taken to identify the perpetrator of the fraud.

Claims

1. A method of operating a communications system including an edge router, the method comprising:

operating said edge router to perform the steps of;

generating, in a forwarding table, a MAC address forwarding table entry from a MAC address included in a header of a frame received by said edge router;

monitoring a communications session between a device on a network which uses MAC addresses with a server responsible for assigning IP addresses to detect assignment of an IP address corresponding to a MAC address provided in a data portion of a message from said device; and

upon detecting assignment of an IP address corresponding to a MAC address provided in a data portion of said message, creating an entry in an address resolution table associating an assigned IP address with said MAC address provided in the data portion of said message.

2. The method of claim 1, further comprising:

discarding IP packets corresponding to IP addresses for which a MAC address included in said address resolution table does not have a corresponding MAC address entry in said MAC address forwarding table.

3. The method of claim 2, wherein Address Resolution Protocol is not used by said edge router.

4. The method of claim 3, further comprising:

storing in said address resolution table aging information obtained from monitoring information associated with said IP address assignment.

5. The method of claim 4, further comprising;

operating said edge router to monitor for IP address release messages transmitted from said network to the server responsible for assigning IP addresses; and

deleting, in response to detecting an IP address release message, an entry in said address forwarding table corresponding to an IP addresses included in said detected IP address release message.

6. The method of claim 5, further comprising;

operating said edge router to compare a MAC address included in the data portion of an IP address assignment request message to a MAC address included in the header of said IP address assignment request message.

8. The method of claim 1, further comprising:

operating the edge router to transmit MAC address information obtained by accessing a forwarding table included in said edge router in response to a request for MAC address information corresponding to an IP address assignment request.

7. A method of operating a communications system including an edge router that does not use Address Resolution Protocol, the method comprising:

operating said edge router to perform the steps of;

generating, in a forwarding table, a MAC address forwarding table entry from a MAC address included in a header of a frame received by said edge router;

monitoring a communications session between a device on a network which uses MAC addresses with a server responsible for assigning IP addresses to detect assignment of an IP address corresponding to a MAC address provided in a data portion of a message from said device;

upon detecting assignment of an IP address corresponding to a MAC address provided in a data portion of said message, creating an entry in an address resolution table associating an assigned IP address with said MAC address provided in

discarding IP packets corresponding to IP addresses for which a MAC address included in said address resolution table does not have a corresponding MAC address entry in said MAC address forwarding table;

storing in said address resolution table aging information obtained from monitoring information associated with said IP address assignment;

operating said edge router to monitor for IP address release messages transmitted from said network to the server responsible for assigning IP addresses;

deleting, in response to detecting an IP address release message, an entry in said address forwarding table corresponding to an IP addresses included in said detected IP address release message;

operating said edge router to compare a MAC address included in the data portion of an IP address assignment request message to a MAC address included in the header of said IP address assignment request message; and

generating a security alert signal in response to detecting a mismatch between the MAC address included in the data portion of said IP address assignment request message and said MAC address included in the header of said IP address assignment request message.

9. A method of operating a communications system including an edge router that does not use Address Resolution Protocol, the method comprising:

operating said edge router to perform the steps of;

generating, in a forwarding table, a MAC address forward table entry from a MAC address included in a header of a frame received by said edge router;

monitoring a communications session between a device on a network which uses MAC addresses with a server responsible for assigning IP addresses to detect assignment of an IP address corresponding to a MAC address provided in a data portion of a message from said device;

upon detecting assignment of an IP address corresponding to a MAC address provided in a data portion of said message, creating an entry in an address resolution table associating an assigned IP address with said MAC address provided in the data portion of said message;

operating the edge router to transmit MAC address information obtained by accessing a forwarding table included in said edge router in response to a request for MAC address information corresponding to an IP address assignment request; and

operating said server to deny said IP address assignment request when said MAC address information obtained by accessing said forwarding table indicates a discrepancy between a MAC address included in the IP address assignment request and MAC address information included in said forwarding table.

10. The method of claim 9, wherein said MAC address information obtained by accessing said forwarding table indicates that the MAC address is not included in the edge router forwarding table.

11. A communication system comprising:

an edge router including;

means for generating, in a forwarding table, a MAC address forwarding table entry from a MAC address included in a header of a frame received by said edge router;

means for monitoring a communications session between a device on a network which uses MAC addresses with a server responsible for assigning IP addresses to detect assignment of an IP address corresponding to a MAC address provided in a data portion of a message from said device; and

means for creating an entry in an address resolution table associating an assigned IP address with said MAC address provided in the data portion of said message upon detecting assignment of an IP address corresponding to a MAC address provided in a data portion of said message.

12. The communication system of claim 11, wherein support for Address Resolution Protocol is disabled in said edge router.

13. The communication system of claim 12, wherein said edge router further includes:

means for discarding IP packets corresponding to IP addresses for which a MAC address included in said address resolution table does not have a corresponding MAC address entry in said MAC address forwarding table.

14. The communications system of claim 13, wherein said edge router further comprises:

an address resolution table including IP address aging information obtained from monitoring information associated with said IP address assignment.

15. The communications system of claim 14, wherein said edge router further includes:

means for monitoring for IP address release messages transmitted from said network to the server responsible for assigning IP addresses; and

means for deleting, in response to detecting an IP address release message, an entry in said address forwarding table corresponding to an IP addresses included in said detected IP address release message.

16. The communications system of claim 15, wherein said edge router further comprises:

means for comparing a MAC address included in the data portion of an IP address assignment request message to a MAC address included in the header of said IP address assignment request message.

17. A communication system comprising:

an edge router wherein support for Address Resolution Protocol is disabled in said edge router, said edge router including;

means for generating, in a forwarding table, a MAC address forwarding table entry from a MAC address included in a header of a frame received by said edge router;

means for monitoring a communications session between a device on a network which uses MAC addresses with a server responsible for assigning IP addresses to detect assignment of an IP address corresponding to a MAC address provided in a data portion of a message from said device;

means for creating an entry in an address resolution table associating an assigned IP address with said MAC address provided in the data portion of said message upon detecting assignment of an IP address corresponding to a MAC address provided in a data portion of said message;

means for discarding IP packets corresponding to IP addresses for which a MAC address included in said address resolution table does not have a corresponding MAC address entry in said MAC address forwarding table;

an address resolution table including IP address aging information obtained from monitoring information associated with said IP address assignment;

means for monitoring for IP address release messages transmitted from said network to the server responsible for assigning IP addresses;

means for deleting, in response to detecting an IP address release message, an entry in said address forwarding table corresponding to an IP addresses included in said detected IP address release message;

means for comparing a MAC address included in the data portion of an IP address assignment request message to a MAC address included in the header of said IP address assignment request message; and

means for generating a security alert signal in response to detecting a mismatch between the MAC address included in the data portion of said IP address assignment request message and said MAC address included in the header of said IP address assignment request message.

18. The communications system of claim 17, further comprising:

means for transmitting MAC address information obtained by accessing a forwarding table included in said edge router to said server in response to a request for MAC address information corresponding to an IP address assignment request.

19. The communications system of claim 18, wherein said MAC address information indicates whether or not a MAC address included in said IP address assignment request is present in a layer 2 forwarding table included in said edge router.

20. A machine-readable medium, comprising a set of machine-readable instructions for controlling a machine to perform the steps of:

generating, in a forwarding table, a MAC address forwarding table entry from a MAC address included in a header of a frame received by said edge router;

monitoring a communications session between a device on a network which uses MAC addresses with a server responsible for assigning IP addresses to detect assignment of an IP address corresponding to a MAC address provided in a data portion of a message from said device; and

upon detecting assignment of an IP address corresponding to a MAC address provided in a data portion of said message, creating an entry in an address resolution table associating an assigned IP address with said MAC address provided in the data portion of said message.