Method and arrangement for preventing illegitimate use of IP addresses
First Claim
1. A method for preventing illegitmate use of an Internet Protocol (IP) address by a subscriber device in an IP network, the network including a switch node and at least one DHCP Dynamic Host configuration Protocol (DHCP) server, said subscriber device in communication with the switch node, the method including the steps of:
- creating a list of trusted ones of the DHCP servers in said switch node;
transmitting by the subscriber device receiving from the subscriber a DHCP request message for an IP address;
forwarding the DHCP request message;
receiving a reply message by said switch node which carries from one of the DHCP servers, said reply message carrying an assigned subscriber IP address, and said switch node comprising a list noting trusted ones of the DHCP servers;
analysing the reply message, wherein said analysing comprises determining the reply message by said switch node to be a DHCP message and having a source address originating from one of the a trusted DHCP servers server;
updating a filter dynamically in the switch node, the filter storing an identification of the subscriber device and the assigned subscriber IP address;
transmitting a frame from the subscriber device usingreceiving a frame from the subscriber device having a source IP address;
comparing in the filter said source IP address with the stored subscriber IP address; and
discarding said frame when said source IP address differs from the stored subscriber IP address.
1 Assignment
0 Petitions
Accused Products
Abstract
Illegitimate use of IP addresses is counteracted. A network (1) includes a switch (5) with ports (P1,P2,P3) to subscribers (6,6A) and a port (PN) to a core network (2) with DHCP servers (4, 4a,4b). The switch includes a database (MAC1, MAC2), port numbers (P1, P2)) and VLAN identities (VLAN1, VLAN2) for the subscribers (6, 6A) and the filter has a list over trusted DHCP servers. Initially onlY DHCP messages from the subscribers are allowed. When the subscriber (6) requests (M1, M3) for an IP address it is checked that it is a DHCP message with valid subscriber values (MAC1, P1, VLAN1). A respond (M2, M4) with an allocated IP address (IP1) and lease time interval (T1) is checked to come from a trusted DHCP server. If so, a list in the filter (9) with correct information is dynamically generated (MAC1, P1, VLAN1, IP1, T1). A message (M5) from the subscriber (6) with false IP address is discarded by the filter. Attempts by the subscriber to use false IP address are counted and a warning signal is generated.
-
Citations
12 Claims
-
1. A method for preventing illegitmate use of an Internet Protocol (IP) address by a subscriber device in an IP network, the network including a switch node and at least one DHCP Dynamic Host configuration Protocol (DHCP) server, said subscriber device in communication with the switch node, the method including the steps of:
-
creating a list of trusted ones of the DHCP servers in said switch node; transmitting by the subscriber device receiving from the subscriber a DHCP request message for an IP address; forwarding the DHCP request message; receiving a reply message by said switch node which carries from one of the DHCP servers, said reply message carrying an assigned subscriber IP address, and said switch node comprising a list noting trusted ones of the DHCP servers; analysing the reply message, wherein said analysing comprises determining the reply message by said switch node to be a DHCP message and having a source address originating from one of the a trusted DHCP servers server; updating a filter dynamically in the switch node, the filter storing an identification of the subscriber device and the assigned subscriber IP address; transmitting a frame from the subscriber device usingreceiving a frame from the subscriber device having a source IP address; comparing in the filter said source IP address with the stored subscriber IP address; and discarding said frame when said source IP address differs from the stored subscriber IP address. - View Dependent Claims (2, 3, 4, 5)
-
-
6. A switch node in an Internet Protocol (IP) network adapted to prevent illegitmate use of an IP address by a subscriber device, the switch node including:
-
at least one port for communication with a subscriber device; an uplink port for communication with DHCP Dynamic Host Configuration Protocol (DHCP) servers in the network; and
,a filter device having a list of the trusted ones of the DHCP servers, the filter device being associated with the ports; wherein the switch node is operative to; receive a subscriber IP address request message from a subscriber device, analyse it to be a DHCP request message and transmit it on the uplink port; receive a reply message on the uplink port, analyse it to be a DHCP reply message having a source IP address from one of the originating from a trusted DHCP servers on the list server; dynamically update the filter with an identification of the subscriber device and a corresponding assigned subscriber IP address contained in the DHCP reply message; receive a frame with a source IP address from a subscriber device; compare in the filter said source IP address with the stored subscriber IP address for the subscriber device; and
,to discard said frame when said source IP address differs from the stored subscriber IP address. - View Dependent Claims (7, 8, 9, 10)
-
-
11. An IP network system comprising a switch node and one or more Dynamic Host Configuration Protocol (DHCP) servers, said switch node and said one or more DHCP servers being connected to a core network, wherein said switch node comprises:
-
at least one port for communication with a subscriber device; an uplink port for communication with the one or more DHCP servers in the network; and a filter device having a list noting trusted ones of the DHCP servers, the filter device being associated with the ports, wherein; the switch node is arranged to receive a subscriber IP address request message from a subscriberd device, analyse it to be a DHCP message and transmit it on the uplink port; the switch node is arranged to receive a reply message on the uplink port, analyse it to be a DHCP reply message originating from a trusted DHCP server; the switch node is arranged to dynamically update the filter with an identification of the subscriber device and a corresponding assigned subscriber IP address contained in the DHCP reply message; the switch node is arranged to receive a frame with a source IP address from a subscriber device; the switch node is arranged to compare in the filter said source IP address with the stored subscriber IP address for the subscriber device; the switch node is arranged to discard said frame when said source IP address differs from the stored subscriber IP address; and the switch node is arranged to accept said frame when said source IP address corresponds to the stored subscriber IP address. - View Dependent Claims (12)
-
Specification