KR100533785B1 - Method for preventing arp/ip spoofing automatically on the dynamic ip address allocating environment using dhcp packet - Google Patents

Abstract

According to an embodiment of the present invention, in an environment where an IP address is allocated using a DHCP (Dynamic Host Configuration Protocol) protocol, snooping a DHCP packet to obtain address allocation information about hosts connected through respective ports, may include 'MAC address and IP'. After configuring the database as 'address' type, the ARP spoofing packet or IP spoofing packet is dropped from each host that can be a potential attacker, thereby preventing ARP or IP spoofing. The present invention relates to a method for automatically preventing ARP / IP spoofing in a dynamic IP address assignment environment using a DHCP packet that can protect a system in a network.

In the method for automatically preventing ARP / IP spoofing in a dynamic IP address assignment environment using DHCP packets according to the present invention, spoofed ARP / IP spoofed by blocking spoofed ARP / IP packets from being input to or transmitted from the host to the host. Blocking the propagation of packets to hosts or higher networks in the system, and blocking spoofing used as a basic means of hacking, has a significant effect of increasing the security of the system and the network.

Description

ARP / IP SPOOFING AUTOMATICALLY ON THE DYNAMIC IP ADDRESS ALLOCATING ENVIRONMENT USING DHCP PACKET}

The present invention relates to a method for automatically preventing ARP / IP spoofing in a dynamic IP address assignment environment using a DHCP packet. Specifically, the present invention relates to a DHCP packet in an environment in which an IP address is allocated using a DHCP (Dynamic Host Configuration Protocol) protocol. Snooping to configure the address allocation information for hosts connected through each port into a database in the form of 'MAC address, IP address' and then the corresponding port from each host that can be a potential attacker. Automatically prevents ARP / IP spoofing in dynamic IP address assignment environment by using DHCP packets to protect ARP or IP spoofing to protect network and system in network by discarding incoming ARP spoofing packet or IP spoofing packet. It is about a method.

As the use of the Internet is increasing day by day, the technology of hacking is also increasing, and nowadays, hacking programs are scattered on the network, and now people who are not experts can become hackers. As such, the fundamental means used for hacking such as DoS, DDoS, Sniffing or Hijacking is ARP or IP spoofing. Among them, ARP (Address Resolution Protocol) spoofing manipulates sender hardware address and sender IP address, using the attacker's MAC address as the source information of the ARP Reply packet for the IP address of another system on the local network. By changing the ARP table of other routers, switches, and hosts in the local network, an attack technique is used to send a packet that is not the IP address of the attacking system to the attacking system's MAC address. In addition, IP spoofing is used as a means of attack that changes its source IP to cause other systems to know who they are or to misunderstand them.

Currently, the damage caused by ARP or IP spoofing attacks accounts for most of the hacking damage, and security is maintained by anyone attacking a specific host or stealing information from the network using spoofing tools that roam the Internet. It is often the case that personal information to be stolen is easily stolen. For example, ARP spoofing can steal various IP packets from other hosts connected to the same internal network, potentially exposing personal information and even exposing financial information. The reality is that it is possible to manipulate server information by stealing passwords. Furthermore, IP spoofing can steal online work done on external networks, leaving more systems vulnerable to attack.

In order to prevent such IP spoofing, the currently used technique is to use a router with filtering function to allocate IP packets from external networks to the local network without using separate IP addresses for hosts connected to each port. There is a method of filtering by using an IP network address and a mask. However, the method uses local network addresses rather than each host's individual IP address for filtering, so that attackers will not be able to catch spoofs using any other address on any local network, as well as no ARP spoofing. There was a problem that could not cope.

In addition, there was no conventional method for ARP spoofing, so it was inevitable to be exposed to an attack. As a defense against this, the ARP table was statically configured in a switch or a host so that the ARP table was not changed by spoofed ARP packets. The method was used. However, the above method has a problem that it is difficult to use it in a place where a network is large or the interface card is frequently replaced because the operator must directly modify the entry of the ARP table every time.

The present invention has been presented to solve the above problems, and an object of the present invention is to monitor an IP address assigned to individual hosts through each port automatically in an environment in which an IP address is assigned using the DHCP protocol. By automatically blocking IP spoofing, you can reduce the damage caused by ARP / IP spoofing attacks, and prevent IP packets from being sent to the wrong host due to a switch or router system operation error in the network. ARP / IP spoofing in dynamic IP address assignment environment using DHCP packets that violate the contract to assign IP address through DHCP and block network allocation by using random IP address. It is to provide an automatic prevention method.

In order to achieve the above object, ARP / IP spoofing automatic prevention method in a dynamic IP address assignment environment using a DHCP packet according to the present invention, IP address assigned from the DHCP server for each host connected to each port of the switch system By monitoring the network, a predetermined database is stored to store the MAC address and IP address of each host, and the modified MAC address and / or IP address of the ARP / IP packets transmitted through the port is used. A method for automatically preventing ARP / IP spoofing in a dynamic IP address assignment environment by using a DHCP packet that prevents ARP / IP spoofing by filtering a first DHCP packet input from a host to a port to request an IP address assignment from a DHCP server. Detect and host the host's client hardware in the Mac Address field of the entry assigned for the host in the database. Recorded, and a first step of initializing the IP address field; A second step of detecting a second DHCP packet transmitted from the port to the host to approve the host's IP address assignment from the DHCP server, extracting the IP address assigned to the host from the second DHCP packet, and writing it in the IP address field ; Detecting a transmission packet that is an ARP and / or an IP packet passing through the port using the host as a source, and extracting a hardware address and an IP address of the host from the transmission packet to specify a host transmitting the transmission packet; A fourth step of searching for an entry whose MAC address field value is the same as the extracted hardware address and whose IP address field value is the same as the extracted IP address; And a fifth step of forwarding the transmission packet if there is a searched entry and blocking transmission of the transport packet if there is no searched entry.

Preferably, when the transmission packet is an ARP packet, in the third step, the sender hardware address is extracted from the hardware address and the sender IP address is extracted from the IP address.

If the transport packet is an IP packet, in the third step, the source MAC address is extracted from the Ethernet header of the transport packet by the hardware address, and the source IP address is extracted from the IP header of the transport packet by the IP address.

In addition, it is preferable to further include a step 3-1 between the third step and the fourth step to block transmission of the transmission packet if the extracted hardware address and the extracted IP address are not unicast.

In addition, in order to achieve the above object, another embodiment of the automatic ARP / IP spoofing prevention method in the dynamic IP address assignment environment using the DHCP packet according to the present invention, to request the assignment of the IP address to the DHCP server Detecting a first DHCP packet input from a host to a port, recording a client hardware address of the host in a MAC address field of an entry assigned to the host in a database, and initializing an IP address field; A second step of detecting a second DHCP packet transmitted from the port to the host to approve the host's IP address assignment from the DHCP server, extracting the IP address assigned to the host from the second DHCP packet, and writing it in the IP address field ; Detecting an IP packet passing through the port using the host as a destination, and extracting a destination MAC address and a destination IP address from the IP packet; A fourth step of retrieving from the database an entry whose MAC address field value is equal to the destination MAC address and whose IP address field value is equal to the destination IP address; And forwarding an IP packet if there is a searched entry, and blocking transmission of the IP packet if there is no searched entry.

Preferably, the third step and the fourth step further includes a step 3-1 of forwarding the destination MAC address and the destination IP address if they are not unicast.

Further, in each of the above embodiments, the first step may include: a first step of detecting a first DHCP packet input from a host to a port; Extracting the client hardware address of the host and the message type of the first DHCP packet from the first DHCP packet; If the message type is DISCOVER, steps 1-3 of searching for an entry in the database whose MAC address field value is the same as the client hardware address; 1-4, if there is an entry found, writing the client hardware address in the MAC address field of the entry and '0.0.0.0' in the IP address field; And if there is no entry found, steps 1-5 of writing the client hardware address in the MAC address field of the new entry and '0.0.0.0' in the IP address field, wherein steps 1-4 and 1-5 are optional. To be performed as

At this time, the database further includes an aging time field for recording the time of deletion of the unnecessary entries of each entry, and in steps 1-4 and 1-5, to record the maximum waiting time which is a predetermined value in the aging time field. and,

In addition, the second step, the second step of detecting a second DHCP packet transmitted from the port to the host; Extracting the client hardware address of the host, the assigned IP address and the message type of the second DHCP packet from the second DHCP packet; Step 2-3 of searching for an entry in the database whose MAC address field value is the same as the client hardware address; If the retrieved entry exists and the message type is ACK, steps 2-4 of recording the client hardware address in the MAC address field of the entry and the IP address assigned in the IP address field; And if the searched entry exists and the message type is NACK, steps 2-5 of deleting the searched entry, and steps 2-4 and 2-5 are selectively performed.

At this time, the database further includes an aging time field for recording the deletion time of the unnecessary entries of each entry, in step 2-2, extract the IP address re-list from the second DHCP packet, and in step 2-4 Record the IP address rename in the time field.

The method may further include a sixth step of reducing the aging time field value by a predetermined unit and deleting the corresponding entry when the aging time field value becomes '0', and the sixth step may be performed irrespective of each step and order. .

Hereinafter, with reference to the accompanying drawings will be described in detail the advantages, features and preferred embodiments of the present invention.

DHCP packet format

The DHCP packet format is shown in FIG. The DHCP packet is a packet exchanged between the client and the server in order to allocate an IP address to the DHCP client. Each field will be described below.

First, the OP code indicates 'Request' if '1', 'Reply' for '2', 'Ethernet' for hardware type value '1', and 'Experimental Ethernet' for '2'. The hardware address length is allocated to the hardware address area of 16 bytes, and actually represents the length of the address according to the hardware type. Hop count is used by the relay agent.

The transaction ID is a value that is arbitrarily chosen by the client as a value indicating the association of the message and the response between the client and the server. The Number of Seconds represents the time taken since the client started the process of acquiring or renewing an IP address. .

In addition, the client IP address is the client's IP address, which is used by the client to indicate to the server that its IP address is valid, and Your IP address is used by the server to inform the client of the client's address. The server IP address indicates to the client the address of the next server that the client will use in the configuration process. The name of the next server is recorded in the Server Host Name field. The gateway IP address indicates the IP address of the relay agent. The gateway IP address records the address of the interface that received the DHCP packet from the relay agent. The boot file name indicates the name of the file that the client should request to the next server. .

Options include 'DHCP message type (code 53)', 'Requested IP Address (code 50)' and 'IP address lease time (code 51)'.

In addition, the flags (flags) can be easily understood by those skilled in the art to which the present invention pertains, and thus, detailed descriptions thereof will be omitted.

Table 1 shows each message type exchanged between DHCP client and server.

value Message type Address assignment / release One DHCPDISCOVER Off (require new IP address) 2 DHCPOFFER Off (suggest new IP address) 3 DHCPREQUEST Release or Retain (Require New IP Address or Renew) 4 DHCPDECLINE Off (deny to use assigned address) 5 DHCPACK Assignment (Completes the process of assigning addresses available to the host) 6 DHCPNACK Release (deny permission to use host requested) 7 DHCPRELEASE Release (voluntarily release the address the host is using) 8 DHCPINFORM Not applicable 9 DHCPFORCERENEW Not applicable

2. DHCP Process

In order to assign an IP address to a host which is a client through DHCP, a certain packet is exchanged between the client and the server. The state change of the client is shown in FIG. FIG. 2 is based on RFC2131 and RFC3203, and the contents shown in FIG. 2 are easily understood by those skilled in the art, and thus detailed descriptions thereof will be omitted.

The process of assigning an IP address to a DHCP client may be divided into a process of allocating a new IP address and a process of renewing an already allocated IP address, which is illustrated in FIG. 3. 3A illustrates a process in which a client is assigned a new IP address, and FIG. 3B illustrates a process in which the client renews an IP address that is already assigned.

As shown in FIG. 3A, when the client receives a new IP address, the client goes through a DISCOVER, OFFER, REQUEST, and ACK process between the DHCP client and the server. After receiving the DHCP ACK, the client can use the assigned IP address. In addition, if a client needs a new IP address after it is assigned an IP address, it will start over from DHCP DISCOVER. On the other hand, in case of renewing the already allocated IP address, as shown in FIG. 3B, only the REQUEST and ACK processes are performed.

3. System Configuration

The configuration of a system for assigning IP addresses to each host using DHCP is shown in FIG. 4 is a system configuration diagram for DHCP monitoring according to the present invention. As shown in FIG. 4, a network is connected to an uplink port of switch A, which is an L2 or L3 switch, and each host (hosts A1, A2, A3, ..) is connected to a downlink port. Another switch B is connected. In addition, another host B1, B2, ... is connected to the downlink port of the switch B, which is an L2 switch. Each host (A1, A2, A3, B1, B2 ..) performs the DHCP protocol and is assigned an IP address from a DHCP server connected to switch A.

At this time, for hosts A1, A2, and A3 directly connected to Switch A, the IP address assigned through each port can be known by snooping DHCP packets passing through the downlink port of Switch A. When managed with, you can see which IP address the host with which MAC address is assigned to. In this way, a database (DHCP monitoring database) can be established for each host, and the spoofed ARP / IP packets can be filtered out by comparing the source / destination IP address input from each port with the established database. Each table in the DHCP monitoring database consists of each host's MAC address, assigned IP address, bound and aging time fields.

More specifically, when the packet input from the ports in the host direction is an ARP packet, if the sender hardware address and the sender IP address in the ARP packet are unicast addresses, they are retrieved from the DHCP monitoring database. If it is an address value, forward the packet. If the address value does not exist, the packet is regarded as a spoofed hardware address or an IP address. In addition, when the input packet is an IP packet, if the source MAC address and the source IP address in the IP packet are unicast addresses, the packet is forwarded to the DHCP monitoring database if the address is present. Then discard the packet, considering the MAC or IP address as spoofed. Similarly, IP packets going out to the host from ports in each host direction are processed identically using the destination MAC / IP address.

As such, the spoofed packet can be prevented from being forwarded, thereby protecting each system or network from attack. In addition, if a host system user randomly assigns an IP address and uses it in a network that allocates IP with DHCP, a packet having the corresponding IP address as a source IP address will be discarded without being transmitted, and thus a random user may use a fixed IP address. It can protect the network from the confusion caused by setting up and using it and increase the efficiency of management.

On the other hand, for hosts (B1, B2, ..) connected through switch B, if DHCP monitoring is performed on switch A but DHCP monitoring is not performed on switch B, spoofing is enabled in switch B. do. However, even in this case, since switch A is performing DHCP monitoring, spoofed IP packets can be filtered out. Of course, if you perform DHCP monitoring on switch B, you can prevent ARP / IP spoofing on hosts B1 and B2, and if you perform IP packet filtering through DHCP monitoring on all switch systems to which the host is directly connected, ARP or IP spoofing is completely disabled. Will be prevented.

In addition, IP packet filtering through DHCP monitoring is not performed only on the port side in the host direction, and may be performed on the uplink if the link in the DHCP server direction is the same port as the uplink. For example, filtering can be done through DHCP monitoring on the same uplink as the server direction of the L2 switch. For uplinks, DHCP monitoring is performed with the destination MAC / IP address for IP packets entering the port. For outgoing IP packets, look for DHCP monitoring with the source MAC / IP address. On the other hand, since the DHCP packet is a broadcast packet, it is not possible to automatically determine which port is the downlink and the uplink based on the flow of the DHCP packet. Therefore, the MAC / IP address to be searched is changed whether it is a source or a destination, so that the operator who defines the characteristics of the link sets it.

On the other hand, the DHCP monitoring and packet filtering method as described above may be implemented in software only, or may be implemented by ASIC on a hardware chip, may be implemented by using a combination of software and hardware chip. For example, you can build a DHCP monitoring database through software, and packet filtering can be done through a hardware chip.

Hereinafter, a process of building a DHCP monitoring database by monitoring DHCP packets passing through each port and a process of puttering spoofed ARP or IP packets using the established database will be described.

4. DHCP monitoring

DHCP monitoring detects the IP addresses assigned to hosts connected to a port (link), and as a result, packet filtering can be performed through the established DHCP monitoring database. In other words, it looks at the IP address assigned to each host by sniffing (snooping) DHCP packets from a single port xDSL modem or network device such as multiple ports xDSLAM, switch, or router system. Host hardware address and assigned IP address' are built and managed as a table-based DHCP monitoring database. The DHCP monitoring database thus constructed is used to filter spoofed ARP / IP packets.

Detecting IP addresses assigned by DHCP protocols for hosts connected to a particular port consists of tracking the IP address assignments while monitoring the DHCP protocol status for hosts with each MAC address.

DHCP monitoring and the process of building the DHCP monitoring database through the same are shown in Figures 5a to 5c. 5A is a diagram illustrating a process of monitoring a packet input from each host to each port in a host direction of the switch (Ingress packet monitoring), and FIG. 5B is a diagram of a packet going to each host from each port in a host direction. (Egress packet monitoring) is a diagram showing a process, and FIG. 5C is a diagram illustrating aging of each table entry in the DHCP monitoring database. Each of them will be described below in detail with reference to FIGS. 5A to 5C.

(1) Ingress DHCP packet monitoring

The DHCP monitoring system detects a DHCP packet input to each port from each host, parses the detected DHCP packet if there is, and extracts a client hardware address and a DHCP message type from the packet (ST500, ST505). Next, the table in the DHCP monitoring database is searched by the client hardware address to determine the DHCP message type if there is a match (ST510 to ST520). The client hardware address, the key of the DHCP monitoring database lookup, is the same as the source MAC address in the MAC frame.

If the message type is DISCOVER, the value of each field of the matched entry, MAC address is the client hardware address, IP address is 0.0.0.0, the aging time is' MAX_WATING_TIME ', and the bound (BOUND) =' 0 'To be updated (ST525).

As described above, each host transmits a DHCP DISCOVER, a DHCP REQUEST, a DHCP DECLINE, a DHCP RELEASE to a DHCP server according to a DHCP protocol execution state, and a packet such as a DHCP OFFER, a DHCP ACK, a DHCP NAK, or the like is transmitted from the DHCP server. Is delivered to. In this case, sending a DHCP DISCOVER from a specific MAC address indicates that the host with that MAC address has started the IP address allocation process through the DHCP protocol. Make a note of the request in the DHCP monitoring table. On the other hand, if only a DHCP request is sent from a host and a response is not received from the server, the entry for the host in the DHCP monitoring table is occupied only by space, so to prevent this, define 'MAX_WAITING_TIME' and use it as aging time. do.

The pre-recording of the MAC address for the host that sent the DHCP request as the client hardware address of the DHCP packet means that the DHCP packet itself is sent as a broadcast, so when a response is received from the server, a response packet is sent from that port. This is to distinguish whether or not it is for a packet.

Meanwhile, if the DHCP message type is RELEASE or DECLINE, the matched entry is deleted (ST530 to ST535). The DHCP DECLINE packet is used to check if a host is using someone through ARP for an IP address assigned by the server and to tell the DHCP server if someone is already using it. At this time, the host itself will try to get a new IP address starting from DHCP DISCOVER. DHCP RELEASE is also used to request the DHCP server to deallocate when it is no longer using an IP address that has already been assigned and used. Therefore, when the DHCP monitoring system detects a DHCP DECLINE or a DHCP RELEASE, the entry for the host having the address of the client hardware address field of the DHCP packet is no longer needed, and therefore, is deleted from the DHCP monitoring table.

In addition, even if there is no match in ST515, if the message time is determined and the message type is DISCOVER, information about the host is recorded in the empty entry to generate a new entry (ST540 and ST545).

(2) egress DHCP packet monitoring

Similarly, the DHCP monitoring system detects DHCP packets going out from each port to each host, parses any detected DHCP packets, and then extracts the client hardware address, Your IP address, DHCP message type, and IP address re-list (ST550). , ST555). Next, the table of the DHCP monitoring database is searched by the client hardware address to extract the matched entry, and the type of the DHCP message is determined (ST560 to ST570).

At this time, if the DHCP message type is ACK, it indicates that an IP address is allocated to the host connected to the corresponding port, so that each field value of the matched entry is updated (ST575). Specifically, MAC addresses are updated to client hardware addresses, IP addresses to Your IP addresses, aging times to IP address leases, and BOUND to '1'. If the DHCP message type is NACK, the matched entry is deleted (ST580 and ST585).

An example of the DHCP monitoring table constructed through the above process is shown in Table 2.

number H / W address Assigned IP address Aging Time One 12: 34: 56: 00: 00: 01 200.1.1.2 7200 Secs (Lease Time Aging) 2 12: 34: 56: 00: 00: 0B 200.1.1.5 732 Secs (Lease Time Aging) 3 12: 34: 56: 00: 00: 0C 200.1.1.33 4733 Secs (Lease Time Aging) 4 12: 34: 56: 00: 20: 22 16 Secs (Waiting Time Aging) 5 12: 34: 56: 00: 30: 01 27 Secs (Waiting Time Aging)

In Table 2, hosts 1, 2, and 3 receive an ACK packet from the server and are assigned an IP address. The IP address lease time is set as the aging time. In addition, hosts 4 and 5 transmit a DISCOVER packet to the server, but have not received an ACK or NACK packet and have not been assigned an IP address. As a result, 'MAX_ WAITING_TIME' is set as an aging time.

When the DHCP monitoring system itself is restarted, the configured DHCP monitoring database is saved as a file to restore normal packet forwarding by retaining the information already created between the client and server in the DHCP monitoring system, You should be able to restore the database. In this case, there may be a temporary mismatch between allocation information and lease time, but this does not affect switching or routing, and ARP / IP spoofing prevention is still normal and can be ignored.

(3) Aging

On the other hand, when a host assigned an IP address using DHCP no longer uses the IP address, DHCP RELEASE is not always performed. In this case, the DHCP monitoring system should determine this and remove the corresponding entry. Therefore, the aging module gradually decreases the aging time after setting the IP address lease time for the entry generated by the detection of the DHCP ACK, and assumes that the entry is no longer used when the aging time becomes '0'. Delete it. However, if the DHCP ACK for the MAC address of the host is detected again by the renewal request from the host before the aging time is '0', the table entry is set to the IP address time in the currently detected DHCP ACK packet. Will be updated.

Also, for hosts that do not receive ACK or NACK packets from the server after an entry is made in the DHCP monitoring database by sending a DISCOVER packet, 'MAX_WAITING_TIME' is used as the aging time so that the space in the DHCP monitoring database is not required. Prevent it from being occupied.

Meanwhile, in FIG. 5C, the bound (BOUND, B) value indicates whether the IP address allocation is completed using DHCP to the corresponding host. If the bound value is '0', it indicates that the IP address has not been assigned yet. '1' indicates that IP address allocation is completed.

5. Packet Filtering

Once the DHCP monitoring database is established, the system or network can be prevented from being attacked by detecting and filtering spoofed ARP or IP packets using the MAC address, IP address and aging time value of each table. That is, the source MAC / IP address or destination MAC / IP address of a packet transmitted through the port where DHCP monitoring is performed is searched in the DHCP monitoring database. If a match is found, the packet is forwarded. By discarding the packet, spoofed ARP / IP packets can be blocked from being transmitted to the upper network.

This packet filtering process is illustrated in FIGS. 6A and 6B. FIG. 6A is a diagram illustrating a process of filtering a packet input from each host to each port in the host direction, and FIG. 6B is a host diagram. A diagram illustrating a process of filtering outgoing packets from each port in the direction to each host (egress packet filtering). Each will be described in detail with reference to FIGS. 6A and 6B as follows.

(1) ingress packet filtering

The DHCP monitoring system detects an ARP or an IP packet input to each port from each host (ST600). If the detected packet is an ARP packet and the protocol of the ARP packet is IP, the sender hardware address and the sender IP address are extracted from the ARP packet (ST605 to ST615), and forwarded if the protocol of the ARP packet is not IP (ST650). If the detected packet is not an ARP packet, that is, an IP packet, the source MAC address is extracted from the Ethernet header and the source IP address from the IP header (ST620).

Next, if the sender hardware address and sender IP address of the ARP packet, and the source MAC address and source IP address of the IP packet are unicast addresses representing ARP or a specific host sending the IP packet, then the extracted sender hardware address Or search the DHCP monitoring database by the source MAC address to find a matching entry (ST625 to ST635). At this time, the ARP packet is searched for the DHCP monitoring database using the sender hardware address as the source MAC address. If the sender hardware address and sender IP address of the ARP packet, and the source MAC address and source IP address of the IP packet are not unicast addresses, the packet is regarded as a spoofed packet (ST650).

If there is a matching entry for the packet, the matched IP address of the matched entry and the source IP address extracted from the packet (sender IP address in the case of ARP packets) are compared, and if they are identical, the corresponding packet is forwarded (ST640, ST645). However, if there is no match for the packet or if the IP address of the matched entry is different from the source IP address or the sender IP address, the corresponding ARP or IP packet is regarded as a spoofed packet (ST650).

(2) egress packet filtering

The DHCP monitoring system detects an IP packet sent to each host from each port, and extracts a destination MAC address from the Ethernet header of the detected IP packet and a destination IP address from the IP header (ST660 and ST665). If the extracted destination MAC address and the destination IP address are unicast, the DHCP monitoring database is searched using the extracted destination MAC address as a key to find a matching entry (ST670 to ST680). Meanwhile, if the destination MAC address and the destination IP address are not unicast, the corresponding packet is forwarded (ST690).

If there is a matching entry for the packet, the IP address of the entry is compared with the destination IP address extracted from the packet, and if both IP addresses are the same, the corresponding packet is forwarded (ST685 and ST690). However, if there is no entry matching the packet or if the IP address of the matched entry and the destination IP address of the packet are different, the packet is regarded as a randomly manipulated or invalid packet (ST695).

In this way, by discarding IP packets with a destination MAC address and a destination IP address that the DHCP server has not assigned to the host, the IP packet can be prevented from being sent to the wrong host, thereby preventing the wrong host from receiving the wrong packet. have.

Application example

By interworking the IEEE 802.3D table for the L2 switch used in the DHCP monitoring system according to the present invention, the function of the switch chip can be improved, and the L2 switch can be applied even when the Ethernet is not Ethernet.

In addition, by applying the DHCP monitoring and packet filtering method according to the present invention in xDSL modem or xDSLAM in xDSL network using DHCP, attack from ARP or IP spoofing can be prevented.

As described above, the method for automatically preventing ARP / IP spoofing in a dynamic IP address assignment environment using a DHCP packet according to the present invention is provided by blocking spoofed ARP or IP packets from being input to or transmitted from a host to a host. The spoofed ARP / IP packet is prevented from being propagated to a host or a higher network in the system, and the spoofing used as a basic means of hacking is prevented, thereby improving the security of the system and the network.

In other words, the method for automatically preventing ARP / IP spoofing in a dynamic IP address allocation environment using a DHCP packet according to the present invention,

First, by preventing ARP / IP spoofing packets, a generalized hacking method tool, from passing through ports, it is possible to prevent not only individual hosts but also the packets themselves for attack within the network.

Second, by comparing and checking the destination IP address of the packets sent from the port to each host, it is possible to prevent the IP packet from being delivered to the wrong host due to a switch or router system operation error in the network.

Thirdly, if a host user randomly assigns an IP address without using an IP assigned by a DHCP server, randomly in a network that is assigned an IP address using the DHCP protocol by blocking a packet transmitted from the host. It is possible to prevent network confusion that can be caused by the use of fixed IP addresses by users in the network, making network management more convenient and efficient.

Fourth, the aging time can be used to automatically delete unnecessary entries by aging each entry in the DHCP monitoring database.

Fifth, you can filter out spoofed packets automatically by enabling or disabling DHCP monitoring and packet filtering without any system operator intervention.

Finally, DHCP monitoring and filtering can be performed on the switch or router system close to each host to maximize ARP / IP spoofing protection.

While the preferred embodiments of the present invention have been described using specific terms, such descriptions are for illustrative purposes only, and it is understood that various changes and modifications may be made without departing from the spirit and scope of the following claims. Should be done.

1 illustrates the format of a DHCP packet.

2 is a state transition diagram of a DHCP client.

3 is a procedure diagram between a DHCP client and a server.

4 is a system configuration diagram for DHCP monitoring.

5 is a diagram illustrating a process of building a DHCP monitoring database through DHCP monitoring;

6 is a flowchart illustrating a process of filtering a packet using a DHCP monitoring database.

Claims (12)

For each host connected to each port of the switch system, a predetermined database for monitoring the MAC address and the IP address of each host is monitored by monitoring an IP address allocated from a DHCP server, and the port is used using the database. A method for automatically preventing ARP / IP spoofing in a dynamic IP address assignment environment using DHCP packets that prevents ARP / IP spoofing by filtering MAC addresses and / or IP address-modulated packets among ARP / IP packets transmitted through Detect a first DHCP packet entered from the host to the port to request an assignment of an IP address to the DHCP server, and enter the client hardware address of the host in the MAC address field of the entry assigned to the host in the database. Recording and initializing the IP address field; Detects a second DHCP packet transmitted from the port to the host to approve the IP address allocation of the host from the DHCP server, extracts the IP address assigned to the host from the second DHCP packet, and selects the IP address. A second step of writing in a field; Detect a transport packet that is an ARP and / or an IP packet passing through the port using the host as a source, and extract a hardware address and an IP address of the host to specify the host that transmits the transport packet from the transport packet. A third step of doing; A fourth step of searching for an entry from the database, wherein the MAC address field value is the same as the extracted hardware address and the IP address field value is the same as the extracted IP address; And And forwarding the transport packet if there is a searched entry, and blocking the transmission of the transport packet if there is no searched entry, and automatically preventing ARP / IP spoofing in a dynamic IP address assignment environment using a DHCP packet. Way. For each host connected to each port of the switch system, a predetermined database for monitoring the MAC address and the IP address of each host is monitored by monitoring an IP address allocated from a DHCP server, and the port is used using the database. A method for automatically preventing ARP / IP spoofing in a dynamic IP address assignment environment by using a DHCP packet which prevents ARP / IP spoofing by filtering an IP address-modulated packet among packets transmitted through Detect a first DHCP packet entered from the host to the port to request an assignment of an IP address to the DHCP server, and enter the client hardware address of the host in the MAC address field of the entry assigned to the host in the database. Recording and initializing the IP address field; Detects a second DHCP packet transmitted from the port to the host to approve the IP address allocation of the host from the DHCP server, extracts the IP address assigned to the host from the second DHCP packet, and selects the IP address. A second step of writing in a field; Detecting an IP packet passing through the port using the host as a destination, and extracting a destination MAC address and a destination IP address from the IP packet; A fourth step of searching for entries from the database, wherein the MAC address field value is the same as the destination MAC address and the IP address field value is the same as the destination IP address; And And forwarding the IP packet if there is a searched entry, and blocking the transmission of the IP packet if there is no searched entry, and automatically preventing ARP / IP spoofing in a dynamic IP address assignment environment using a DHCP packet. Way. The method according to claim 1 or 2, The first step, Detecting the first DHCP packet inputted from the host to the port; Extracting a client hardware address of the host and a message type of the first DHCP packet from the first DHCP packet; Step 1-3, when the message type is DISCOVER, searching for an entry in the database whose MAC address field value is the same as the client hardware address; 1-4, if there is an entry found, writing the client hardware address in the MAC address field of the entry and '0.0.0.0' in the IP address field; And If there is no entry found, steps 1-5 of recording the client hardware address in the MAC address field of the new entry and '0.0.0.0' in the IP address field; Method 1-4 and step 1-5 are selectively performed ARP / IP spoofing automatic prevention method in a dynamic IP address assignment environment using a DHCP packet. The method of claim 3, wherein The database further comprises an aging time field for recording when to delete unnecessary entries of each entry, In steps 1-4 and 1-5, ARP / IP spoofing is automatically prevented in a dynamic IP address allocation environment using a DHCP packet, characterized in that the maximum waiting time, which is a predetermined setting value, is recorded in the aging time field. Way. The method of claim 4, wherein A sixth step of reducing the aging time field value by a predetermined unit and deleting the corresponding entry when the aging time field value becomes '0', The sixth step may be performed irrespective of the steps and the order of the ARP / IP spoofing in a dynamic IP address assignment environment using a DHCP packet. The method according to claim 1 or 2, The second step, Detecting the second DHCP packet transmitted from the port to the host; Extracting the client hardware address of the host, the assigned IP address and the message type of the second DHCP packet from the second DHCP packet; Searching for entries in the database where the MAC address field value is the same as the client hardware address; If the retrieved entry exists and the message type is ACK, recording the client hardware address in the MAC address field of the entry and the assigned IP address in the IP address field; And If the searched entry exists and the message type is NACK, the step 2-5 of deleting the searched entry; Method 2-4 and step 2-5 are selectively performed ARP / IP spoofing automatic prevention method in a dynamic IP address assignment environment using a DHCP packet. The method of claim 6, The database further comprises an aging time field for recording when to delete unnecessary entries of each entry, In step 2-2, extract the IP address re-list from the second DHCP packet, In step 2-4, ARP / IP spoofing automatic prevention method in a dynamic IP address assignment environment using a DHCP packet, characterized in that the recording of the IP address in the aging time field. The method of claim 7, wherein A sixth step of reducing the aging time field value by a predetermined unit and deleting the corresponding entry when the aging time field value becomes '0', The sixth step may be performed irrespective of the steps and the order of the ARP / IP spoofing in a dynamic IP address assignment environment using a DHCP packet. The method of claim 1, The transport packet is an ARP packet, In the third step, A method for automatically preventing ARP / IP spoofing in a dynamic IP address allocation environment using a DHCP packet, comprising: extracting a sender hardware address with the hardware address and extracting a sender IP address with the IP address. The method of claim 1, The transport packet is an IP packet, In the third step, In the dynamic IP address assignment environment using a DHCP packet, the source MAC address is extracted from the Ethernet header of the transport packet with the hardware address, and the source IP address is extracted from the IP header of the transport packet with the IP address. How to automatically prevent ARP / IP spoofing. The method of claim 1, Between the third and fourth steps, If the extracted hardware address and the extracted IP address is not unicast, further comprising the step 3-1 of blocking the transmission of the transmission packet ARP / in the dynamic IP address assignment environment using a DHCP packet How to prevent IP spoofing automatically. The method of claim 2, Between the third and fourth steps, And forwarding the destination MAC address and the destination IP address if the destination IP address is not unicast, in step 3-1.