Method and arrangement for preventing illegitimate use of IP addresses

• US RE47,253 E1
• Filed: 01/30/2015
• Issued: 02/19/2019
• Est. Priority Date: 11/06/2002
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Anders Nesz, Peter, Johansson, Thomas, Valentin Juhl, Michael
• Primary Examiner(s): Saadat, Cameron
• Application Number:
  US14/609,631
• Time in Patent Office: 1,481 Days
• Field of Search: 709227
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: H04L 29/06102 Implementation details of TCP/IP or UDP/IP stack architecture; specification of modified or new header fields protocols engines in general H04L29/06081; OSI stack based layering aspects H04L29/08009; protocol header analysis in general H04L29/0653
• CPC Class Codes: H04L 61/2015 using the dynamic host configuration protocol [DHCP] or variants
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields

Abstract

Illegitimate use of IP addresses is counteracted. A network (1) includes a switch (5) with ports (P1,P2,P3) to subscribers (6,6A) and a port (PN) to a core network (2) with DHCP servers (4, 4a,4b). The switch includes a database (MAC1, MAC2), port numbers (P1, P2) and VLAN identities (VLAN1, VLAN2) for the subscribers (6, 6A) and the filter has a list over trusted DHCP servers. Initially only DHCP messages from the subscribers are allowed. When the subscriber (6) requests (M1, M3) for an IP address it is checked that it is a DHCP message with valid subscriber values (MAC1, P1, VLAN1). A respond (M2, M4) with an allocated IP address (IP1) and lease time interval (T1) is checked to come from a trusted DHCP server. If so, a list in the filter (9) with correct information is dynamically generated (MAC1, P1, VLAN1, IP1, T1). A message (M5) from the subscriber (6) with false IP address is discarded by the filter. Attempts by the subscriber to use false IP address are counted and a warning signal is generated.

Claims

1. A method for preventing illegitmate use of an Internet Protocol (IP) address by a subscriber device in an IP network, the network including a switch node and at least one DHCP server, said subscriber device in communication with the switch node, the method including the steps of:

creating a list of trusted ones of the DHCP servers in said switch node;

transmitting by the subscriber device a DHCP request message for an IP address;

receiving a reply message by said switch node which carries an assigned subscriber IP address;

analysing the reply message by said switch node to be a DHCP message and having a source address from one of the trusted DHCP servers;

updating a filter dynamically in the switch node, the filter storing an identification of the subscriber device and the assigned subscriber IP address;

transmitting a frame from the subscriber device using a source IP address;

comparing in the filter said source IP address with the stored subscriber IP address; and

,

discarding said frame when said source IP address differs from the stored subscriber IP address.

2. The method according to claim 1, further comprising the step of storing in the filter a subscriber MAC address, a subscriber physical port number, a subscriber virtual LAN identity and a lease time interval for the assigned subscriber IP address.

3. The method according to claim 1, wherein the subscriber IP address is statically assigned and handled by the DHCP servers.

4. The method according to claim 2, the method including deleting the subscriber identification and the corresponding assigned subscriber IP address from the filter when the lease time interval is out.

5. The method according to claim 1, the method further comprising the steps of:

counting a number of attempts (n) from the subscriber to use an illegitimate IP address;

comparing the number (n) of the attempts with a threshold number (N);

sending a warning signal when the number of attempts exceeds a threshold criteria.

6. A switch node in an Internet Protocol (IP) network adapted to prevent illegitmate use of an IP address by a subscriber device, the switch node including:

at least one port for communication with a subscriber device;

an uplink port for communication with DHCP servers in the network; and

,

a filter device having a list of trusted ones of the DHCP servers, the filter device being associated with the ports;

wherein the switch node is operative to;

receive a subscriber IP address request message from a subscriber device, analyse it to be a DHCP request message and transmit it on the uplink port;

receive a reply message on the uplink port, analyse it to be a DHCP reply message having a source IP address from one of the trusted DHCP servers on the list;

dynamically update the filter with an identification of the subscriber device and a corresponding assigned subscriber IP address contained in the DHCP reply message;

receive a frame with a source IP address from a subscriber device;

compare in the filter said source IP address with the stored subscriber IP address for the subscriber device; and

,

to discard said frame when said source IP address differs from the stored subscriber IP address.

7. The switch node according to claim 6, wherein the switch node is further operative to store in the filter a subscriber MAC address, a subscriber physical port number, a subscriber virtual LAN identity and a lease time interval for the assigned subscriber IP address.

8. The switch node according to claim 6, wherein the subscriber IP address comprises a statically assigned address which is handled by the DHCP servers.

9. The switch node according to claim 7, wherein the switch node is further operative to delete the subscriber identification and the corresponding assigned subscriber IP address from the filter when the lease time interval is out expires.

10. The switch node according to claim 6, wherein the filter comprises a counter operative to count a number (n) of discarded frames on the subscriber port, to compare the number (n) of the discarded frames with a threshold number (N), and to send a warning signal when the number of discarded frames exceeds a threshold criterion.

11. A method in a switch node coupled upstream to at least one Dynamic Host Configuration Protocol (DHCP) server and coupled downstream to at least one subscriber device, the method including the steps of:

creating a first table of trusted ones of the DHCP servers in the switch node;

receiving, by the switch node, from the at least one subscriber device, a DHCP request message for an IP address

transmitting, by the switch node, the DHCP request message to one of the trusted DHCP servers;

receiving, by the switch node, a reply message from the trusted DHCP server, the reply including an assigned subscriber IP address;

analysing the reply message by the switch node to be a DHCP message and having a source address from one of the trusted DHCP servers according to the first table;

updating a second table dynamically in the switch node, the second table storing an identification of the subscriber device and the assigned subscriber IP address;

transmitting, by the switch node, to the subscriber device, a reply message which carries the assigned subscriber IP address;

receiving, by the switch node, a frame from the subscriber device using a source IP address;

comparing the source IP address with the stored subscriber IP address in the second table;

discarding the frame when the source IP address differs from the stored subscriber IP address of the second table; and

accepting the frame when the source IP address matches the stored subscriber IP address of the second table.

12. The method according to claim 11, further comprising the step of storing in the second table a subscriber MAC address, a subscriber physical port number, a subscriber virtual LAN identity and a lease time interval for the assigned subscriber IP address.

13. The method according to claim 11, wherein the subscriber IP address is statically assigned and handled by the DHCP servers.

14. The method according to claim 12, the method including deleting the subscriber identification and the corresponding assigned subscriber IP address from the second table when the lease time interval is out.

15. The method according to claim 11, the method further comprising the steps of:

counting a number of attempts (n) from the subscriber to use an IP address that does not match that contained in the second table;

comparing the number (n) of the attempts with a threshold number (N);

sending a warning signal when the number of attempts exceeds the threshold number.

16. A switch node configured to prevent illegitmate use of an IP address by a subscriber device, the switch node comprising:

at least one downlink port for communication with a subscriber device;

at least one uplink port for communication with at least one Dynamic Host Configuration Protocol (DHCP) server in a network; and

,

a first table having a list of trusted ones of the DHCP servers, the first table being associated with the ports;

processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, cause the switch node to;

receive a subscriber IP address request message from a subscriber device, analyse it to be a DHCP request message and transmit it on the uplink port;

receive a reply message on the uplink port, analyse it to be a DHCP reply message having a source IP address from one of the trusted DHCP servers in the first table;

dynamically update a second table with an identification of the subscriber device and a corresponding assigned subscriber IP address contained in the DHCP reply message;

receive a frame with a source IP address from a subscriber device;

compare the source IP address with the stored subscriber IP address for the subscriber device in the second table;

discard the frame when the source IP address differs from the stored subscriber IP address; and

accept the frame when the source IP address matches the stored subscriber IP address of the second table.

17. The switch node according to claim 16, wherein the switch node is further operative to store in the second table a subscriber MAC address, a subscriber physical port number, a subscriber virtual LAN identity and a lease time interval for the assigned subscriber IP address.

18. The switch node according to claim 16, wherein the subscriber IP address comprises a statically assigned address which is handled by the DHCP servers.

19. The switch node according to claim 17, wherein the switch node is further operative to delete the subscriber identification and the corresponding assigned subscriber IP address from the filter when the lease time interval expires.

20. The switch node according to claim 16, further comprising a counter operative to count a number (n) of discarded frames on the subscriber port, to compare the number (n) of the discarded frames with a threshold number (N), and to send a warning signal when the number of discarded frames exceeds the threshold number.