KR101080734B1 - Method and apparatus for preventing spoofing - Google Patents

Abstract

According to the present invention, one or more agents installed in one or more hosts transmit an information packet including the IP address and MAC address of the host to the controller, and the controller constructs an IP-MAC database including the IP address and MAC address and outbound. (Out-Bound) If the IP information or MAC information of the packet does not match the IP-MAC database, filter outbound packets, and look up the IP address corresponding to the MAC information of the outbound packet in the IP-MAC database. Relates to a method and device for tracking the actual IP address. One aspect of the invention, the step of receiving one or more information packets including the IP address and MAC address of one or more hosts, including the IP information and MAC information contained in the outbound packet transmitted from the host in one or more information packets Comparing the IP-MAC database with the IP address and MAC address of at least one host that has been identified, and if the IP information and MAC information of the outbound packet do not match the IP-MAC database, determining the outbound packet as a spoofed packet. And filtering the spoofed packet.

Description

Spoofing prevention method and apparatus {METHOD AND APPARATUS FOR PREVENTING SPOOFING}

The present invention relates to a method and apparatus for preventing spoofing. Specifically, the present invention, one or more agents installed in one or more hosts transmits an information packet including the IP address and MAC address of the host to the controller, the controller builds an IP-MAC database including the IP address and MAC address If the IP or MAC information of the outbound packet does not match the IP-MAC database, filter the outbound packet and look up the IP address corresponding to the MAC information of the outbound packet in the IP-MAC database to view the actual IP of the spoof. A method and apparatus for tracking an address.

As the use of the Internet increases, so too does the technology of hacking. As such, the underlying means used for hacking such as DoS, DDoS, Sniffing or Hijacking is ARP (Address Resolution Protocol) or IP Spoofing. Among them, ARP spoofing manipulates the sender hardware address and sender IP address. By changing the ARP table of other routers, switches, and hosts in the local network, the ARP spoofing is used to change the MAC address of the attacker's MAC address. It is an attack technique that attaches and delivers to the attack system. In addition, IP spoofing is used as a means of attack that alters its source IP, causing other systems to know who they are or to misunderstand them.

Due to ARP or IP spoofing attacks, personal information that needs to be secured is frequently stolen by using spoofing tools that roam the Internet to steal specific hosts or steal information roaming within the network. For example, ARP spoofing can steal personal information by stealing various IP packets from other hosts connected to the same internal network, and steal server information by stealing administrator-level IDs and passwords of specific servers. It became possible to operate. In addition, IP spoofing makes it easier to expose more systems to attacks if you steal your online work on external networks.

1 illustrates an example ARP spoofing attack technique. Before the ARP spoofing attack, the client 110 exchanges data with the server 140 through the gateway 130. That is, the normal traffic flow 150 passes through the client 110, the gateway 130, and the server 140. However, in order for the ARP spoofing attacker 120 to intercept a session between the ARP spoofing victim (client) 110 and the gateway 130, the ARP spoofing attacker 120 instead of the MAC of the gateway 130 for the ARP spoofing victim 110. The ARP Reply packet is transmitted to the MAC, and the Gateway 130 transmits the ARP Reply packet to the MAC of the ARP spoofing attacker 120 instead of the MAC of the ARP spoofing victim 110. That is, the ARP spoofing attacker 120 performs an ARP spoofing attack 160, and the ARP spoofing attacker 120 intercepts all packets between the ARP spoofing victim 110 and the gateway 130. This ARP spoofing attack technique is used as a dictionary attack and then attempts to man-in-the-middle attack by relaying packets through IP spoofing.

2 illustrates an example IP spoofing attack technique. In the SYN flooding attack scheme, as shown in FIG. 2, the IP spoofing attacker 200 cheats its IP to an arbitrary IP in order to cause a denial of service attack of the Transmission Control Protocol (TCP) service of the target 230. An attempt is made to transmit a large amount of packets to deplete a serviceable session of the target 230.

In general, IP spoofing attacks using ARP spoofing are used to steal sensitive information or distribute malicious code, and most zombie PCs used for DoS, DRDoS, or DDoS attacks are based on IP spoofing attacks.

Although most commonly known ARP spoofing detection methods are applied to security devices, these conventional ARP spoofing detection techniques are based on ARP Reply packet collection, so the dummy hub disappears and the internal network environment where L2 switch is used is considered. When spoof detection is seen almost impossible. In addition, even if the security equipment detects flooding attacks by IP spoofing that DDoS zombies use a lot and blocks the packets, the conventional security method is that the bandwidth of the internal network section where the security equipment is located in the spoof is the attack packet of the zombie PC. Bandwidth wasn't prevented and there was a lot of trouble with Spurper's actual IP tracking.

In order to solve the above problem, an aspect of the present invention is that a controller installed in an internal network at the bottom of a router in which a MAC of a packet transmitted from a host is not changed is obtained from one or more agents installed in one or more hosts. Inbound and outgoing, builds an IP-MAC database containing the IP address and MAC address to filter outbound packets if the IP address or MAC address of the outbound packet does not match the IP-MAC database, and out of the IP-MAC database. An object of the present invention is to provide a method and apparatus for tracking an actual IP address of a spoof by querying an IP address corresponding to a MAC address of a bound packet.

In order to achieve the above object, an aspect of the present invention, receiving one or more information packets including the IP address and MAC address of one or more hosts, IP information and MAC information contained in the outbound packet transmitted from the host Comparing the established IP-MAC database, determining the outbound packet as a spoofed packet if the IP information and the MAC information of the outbound packet do not match the IP-MAC database, and filtering the spoofed packet. And the IP-MAC database provides a spoofing prevention method that includes the IP address and MAC address of one or more hosts included in one or more information packets.

In addition, the IP address corresponding to the MAC information of the spoof packet in the IP-MAC database to provide a spoofing prevention method further comprising the step of tracking the actual IP address of the spoof.

The filtering of the spoofed packet may include: allowing the spoofed packet if the MAC information of the spoofed packet is present in the whitelist, and blocking the spoofed packet if the MAC information of the spoofed packet does not exist in the whitelist. It provides a spoofing prevention method comprising a.

In addition, the receiving step provides a method for preventing spoofing, including receiving one or more information packets from one or more agents installed in one or more hosts.

The receiving may include periodically checking whether one or more hosts have an IP address or MAC address changed, and when the IP address or MAC address is changed, the changed IP address or changed MAC address. It provides a method for preventing spoofing comprising the step of receiving one or more information packets containing from one or more agents.

In addition, an aspect of the present invention to achieve the above object is an anti-spoofing device comprising one or more agents and controllers installed on one or more hosts, one or more agents, one or more including the IP address and MAC address of one or more hosts The above information packet is transmitted to the controller, and the controller analyzes one or more information packets and constructs an IP-MAC database including IP addresses and MAC addresses of one or more hosts, and includes them in an outbound packet transmitted from the host. A comparison unit for comparing the obtained IP information and MAC information with the IP-MAC database, a judging unit for judging the outbound packet as a spoofing packet when the IP information and the MAC information of the outbound packet do not match the IP-MAC database, and spoofing Provided is a spoofing prevention device including a filtering unit for filtering a packet.

In addition, the controller provides a spoofing prevention device further comprises a tracking unit for tracking the IP address corresponding to the MAC information of the spoofing packet in the IP-MAC database to track the actual IP address of the spoof.

The filtering unit may further include a spoofing unit that allows a spoofing packet when the MAC information of the spoofing packet is present in the white list, and a blocking unit that blocks the spoofing packet when the MAC information of the spoofing packet does not exist in the white list. Provide prevention device.

Further, each of the one or more agents includes a checker that periodically checks whether the IP address or MAC address of each of the one or more hosts is changed, and the one or more agents change the changed IP address or changed when the IP address or MAC address is changed. Provided is a spoofing prevention device for transmitting one or more information packets including a MAC address to the controller.

In addition, an aspect of the present invention to achieve the above object is at least one anti-spoofing agent installed on at least one host, at least one anti-spoofing agent, at least one information packet containing the IP address and MAC address of the at least one host Send to the controller, the controller analyzes one or more information packets to build an IP-MAC database containing IP addresses and MAC addresses of one or more hosts, and sends the IP and MAC information contained in the outbound packets sent from the host. Compared to the IP-MAC database, if the IP information and MAC information of the outbound packet does not match the IP-MAC database, the outbound packet is determined as a spoof packet, and provides a spoofing prevention agent for filtering the spoof packet.

In addition, to achieve the above object, an aspect of the present invention is a receiver for receiving one or more information packets including the IP address and MAC address of one or more hosts from one or more agents installed in one or more hosts, analyzing one or more information packets A construction unit for constructing an IP-MAC database including IP addresses and MAC addresses of one or more hosts; a comparison unit for comparing IP information and MAC information included in outbound packets transmitted from the host with the IP-MAC database; When the IP information and MAC information of the bound packet does not match the IP-MAC database, it provides a spoofing prevention controller including a determination unit for determining the outbound packet as a spoofing packet, and a filtering unit for filtering the spoofed packet.

According to the present invention, an agent is installed in each host to periodically check whether the IP address or MAC address is changed, and update the IP-MAC database by providing the controller with the changed IP address or MAC address.

In addition, even if a spoof packet is included in the whitelist of the MAC information of the spoof packet, exception processing can be performed by allowing the spoof packet without blocking the spoof packet.

It can also track the spoof's actual IP address by querying the IP address corresponding to the MAC information of the spoofing packet in the IP-MAC database, block the hijacking attack of ARP spoofing, and enable the zombie host of the internal network used for DDoS. It is possible to detect and eliminate the problem, and in case of flooding attack by IP spoofing, it is possible to prevent the exhaustion of the bandwidth of the internal network to ensure the availability of the network.

1 illustrates an example ARP spoofing attack technique.
2 illustrates an example IP spoofing attack technique.
3 illustrates a network configuration including an agent and a controller according to an embodiment of the present invention.
4 is a flowchart illustrating a spoofing prevention method according to an embodiment of the present invention.
5 is a flowchart illustrating a spoof packet exception processing according to an embodiment of the present invention.
6 illustrates a data structure of an information packet according to an embodiment of the present invention.
7 illustrates a signal processing flow for blocking IP spoofing according to an embodiment of the present invention.
8 is a block diagram of an anti-spoofing device according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intentions or customs of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification.

3 illustrates a network configuration including an agent and a controller according to an embodiment of the present invention. Agents are installed in each of the hosts 300, 310, and 320, and an internal network including the hosts 300, 310, and 320 and the L2 switch 330, and an external network including the gateway 350 and the Internet 360. A controller 340 is provided for relaying traffic therebetween. Since there is no L3 routing between the controller 340 and each of the hosts, the MAC information of packets transmitted from each host is the same as the MAC information of the actual network interface of the host. Although three hosts are illustrated in FIG. 3, the number of hosts may be three or less, or three or more.

Agents installed on the hosts 300, 310 and 320 collect the host's local IP address and MAC address, generate an information packet including the collected IP address and MAC address, and send the generated information packet to the controller 340. do. In this case, the agent periodically checks whether the IP addresses and MAC addresses of the hosts 300, 310, and 320 are changed, and, if the IP address or MAC address is changed, an information packet including the changed IP address or the changed MAC address. Transmit to controller 340. In this case, the information packet includes the total number of physical or logical network interfaces (NIFs) set in the hosts 300, 310, and 320, together with local IP addresses and MAC addresses allocated thereto.

The controller 340 collects an information packet including local IP addresses and MAC addresses of the hosts 300, 310, and 320 from the agent to build the IP-MAC database 370. Referring to FIG. 3, the IP-MAC database 370 includes IP 210.1.1.1 and MAC (00: 0E: A6: 81: 50: F3) of the host 300, and IP (210.1. 1.2) and MAC (00: 0E: A6: 81: 50: F4), IP (210.1.1.3) and MAC (00: 0E: A6: 81: 50: F5) of the host 320 are stored. In FIG. 3, an IP-MAC database having three IP-MAC information is illustrated.

The IP-MAC database 370 is a database that records actual IP addresses and MAC addresses corresponding to the IP addresses of the hosts 300, 310, and 320, and then out-bound packets are sent to the controller 340. If it passes, it is used to determine whether IP spoofed. If the outbound packet is IP spoofed, the IP address corresponding to the MAC information included in the outbound packet retrieved from the IP-MAC database 370 is different from the IP information included in the outbound packet.

Outbound packets from the internal network to the external network are sampled, and the packet information is allowed in the same case, and the packet is blocked in other cases by comparing the IP and MAC information of the packet with the IP-MAC database. If the IP information and the MAC information of the outbound IP packet are different from the IP-MAC database, the actual IP address of the spoof may be tracked by inquiring the IP address corresponding to the MAC information of the outbound IP packet in the IP-MAC database. .

In this case, outbound IP packets with MAC addresses that are not stored in the IP-MAC database for exception handling can be sent to the external network without blocking, and outbound IP packets with MAC addresses on the whitelist are also blocked. It can be sent to an external network without blocking.

4 is a flowchart illustrating a spoofing prevention method according to an embodiment of the present invention. In operation S410, the controller 340 receives an information packet from an agent installed in each of the hosts 300, 310, and 320. In step S420, the controller 340 builds the IP-MAC database 370. In step S430, IP information and MAC information are extracted from the outbound packet. In step S440, it is determined whether the extracted IP information and MAC information match the IP-MAC database. If the extracted IP information and MAC information match the IP-MAC database, in step S450, the controller 340 allows the outbound packet to be transmitted to the external network. On the other hand, if the extracted IP information and MAC information does not match the IP-MAC database, in step S460 it is detected that the outbound packet is a spoofed packet. In step S470, the IP address corresponding to the MAC address of the outbound packet is retrieved from the IP-MAC database to track the actual IP address of the spoof. In step S480, the spoofing packet is blocked.

However, there may be an exception in which spoof packets are not blocked even when outbound packets are detected as spoof packets. For example, outbound packets with MAC addresses that are not stored in the IP-MAC database can be sent to the external network without blocking. Outbound packets with MAC addresses on the whitelist list are also not blocked. Can be sent over the network. Hereinafter, a process of processing an outbound packet having a MAC address in a whitelist will be described.

5 is a flowchart illustrating a spoof packet exception processing according to an embodiment of the present invention. In step S510, it is determined whether the MAC address of the spoof packet exists in the white list. If the MAC address of the spoofed packet is present in the whitelist, step S520 exceptionally allows the packet to be transmitted to the external network. On the other hand, if the MAC address of the spoof packet does not exist in the white list, in step S530 it is blocked from transmitting the packet to the external network.

6 illustrates a data structure of an information packet according to an embodiment of the present invention. The information packet sent from the agent to the controller includes the IP address and MAC address set in the host. The information packet includes the version information 610 of the information packet, the number information 620 of the physical or logical network interface (NIF), and the IP address and MAC address 630, 640, and 650 set in each interface. The IP address and the MAC address are stored as many as the network interface (NIF). The controller receiving the information packet establishes the IP-MAC database according to the IP address and MAC address information extracted from the information packet.

7 illustrates a signal processing flow for blocking IP spoofing according to an embodiment of the present invention. There are two hosts 700a and 700c in the network, the host 700a acts as an IP spoof, and the host 700c acts as a normal host. The agent 700b and the agent 700c are installed in the IP spoof 700a and the normal host 700c, respectively. On the other hand, the network includes a controller 700e and a gateway 700f for relaying traffic between the internal network and the external network.

Agent 700b sends an information packet 720a that includes IP 210.1.1.1 of MAC spoof 700a and MAC (00: 0E: A6: 81: 50: F3) to controller 700e. In addition, the agent 700d transmits an information packet 730a including the IP 210.1.1.2 of the normal host 700c and the MAC (00: 0E: A6: 81: 50: F4) to the controller 700e. . The agents 700b and 700d periodically examine the IP addresses and MAC addresses of the IP spoof 700a and the normal host 700c, and, if there is a change in the IP address or MAC address, the controller transmits an information packet reflecting the changed information. 700e).

The controller 700e builds an IP-MAC database 710 based on the information packet 720a and the information packet 730a. The IP-MAC database 710 is used to determine whether the outbound packet is a spoofed packet.

The IP information included in the packet 730b transmitted from the normal host 700c is 210.1.1.2, and the MAC information is 00: 0E: A6: 81: 50: F4. Since the IP information of 210.1.1.2 and the MAC information of 00: 0E: A6: 81: 50: F4 match the IP-MAC database 710, the packet 730b passes through the controller 700e to the gateway 700f. Will be. Similarly, the packet 730c transmitted from the normal host 700c is transmitted to the gateway 700f through the controller 700e.

Meanwhile, the packet 720b transmitted from the IP spoof 700a is an IP spoofed packet and includes IP information of 218.1.1.1 and MAC information of 00: 0E: A6: 81: 50: F3. The controller 700e extracts the IP information and the MAC information of the packet 720b and compares it with the IP-MAC database 710. In this case, since the IP address and MAC address corresponding to the IP information and the MAC information of the packet 720b do not exist in the IP-MAC database 710, the packet 720b is blocked without being delivered to the external network.

Similarly, packet 720c is an ARP spoofed packet and includes IP information of 210.1.1.2 and MAC information of 00: 0E: A6: 81: 50: F3. The actual IP spoof's actual IP is 210.1.1.1, where 210.1.1.2 is the IP address of the normal host 700c. That is, since the IP address and MAC address corresponding to the IP information and MAC information of the packet 720c, which are ARP spoofed packets, do not exist in the IP-MAC database 710, the packet 720c is blocked without being delivered to the external network. . In this case, the MAC address contained in the blocked packets 720b and 720c is 00: 0E: A6: 81: 50: F3, so the MAC address of 00: 0E: A6: 81: 50: F3 in the IP-MAC database 710. If you look up the IP address corresponding to, 210.1.1.1 will be searched. That is, the actual IP of the spoof 700a can be tracked from the MAC address included in the blocked packet.

8 is a block diagram of an anti-spoofing device according to an embodiment of the present invention. Agents 800a, 800b, 800c, and 800d are respectively installed in the host to transmit information packets 810a, 810b, 810c, and 810d including the IP address and MAC address of the host to the controller 820. The agent 800d may further include a checker 800e that periodically checks whether the IP address or the MAC address of the host where the agent 800d is installed is changed. If the IP address or MAC address is changed, the changed IP address is changed. Or, the information packet including the MAC address is transmitted to the controller 820.

The controller 820 relays the traffic of the internal network and the external network, and since there is no L3 routing between the controller 340 and each of the hosts, the MAC information of the packet transmitted from each host is the same as the MAC information of the actual network interface of the host. .

The controller 820 includes a construction unit 820a that analyzes one or more information packets 810a, 810b, 810c, and 810d to build an IP-MAC database including IP addresses and MAC addresses of one or more hosts. In addition, the controller 820 includes a comparison unit 820b for comparing the IP address and the MAC address included in the outbound packet transmitted from the host with the IP-MAC database.

The controller 820 includes a determination unit 820c that determines the data packet as a spoofing packet when the IP address and the MAC address of the outbound packet do not match the IP-MAC database. In addition, the controller 820 includes a filtering unit 820d for filtering the spoof packet. The filtering unit 820d may allow the spoofing packet to be transmitted to the external network if the MAC address of the spoof packet exists in the whitelist, and the spoofing packet if the MAC address of the spoofing packet does not exist in the whitelist. And a blocking unit 820f that blocks transmission to the external network. In addition, the controller 820 may further include a tracking unit 820g for searching the IP address corresponding to the MAC address of the spoof packet in the IP-database to track the actual IP address of the spoof.

Modules, functional blocks or means of the present embodiment may be implemented in a variety of known elements, such as electronic circuits, integrated circuits, ASICs (Application Specific Integrated Circuit), each may be implemented separately, or two or more may be integrated into one Can be.

As described above, the embodiments have been described for the understanding of the present invention, but as will be appreciated by those skilled in the art, the present invention is not limited to the specific embodiments described herein, but variously without departing from the scope of the present invention. May be modified, changed and replaced. For example, the technique of the present invention may be applied to a picture, an image, etc., which may be displayed by a display such as an LCD instead of a character. Therefore, it is intended that the present invention cover all modifications and variations that fall within the true spirit and scope of the present invention.

300: host 310: host
320: host 330: L2 switch
340 controller 350 gateway
360: Internet 370: IP-MAC Database

Claims (11)

Receiving one or more information packets including IP addresses and MAC addresses of one or more hosts;
Comparing the IP information and the MAC information included in the out-bound packet transmitted from the host with the constructed IP-MAC database;
Determining the outbound packet as a spoofing packet when the IP information and the MAC information of the outbound packet do not match the IP-MAC database; And
Filtering the spoofed packet;
The IP-MAC database includes the IP address and MAC address of the one or more hosts included in the one or more information packets,
Filtering the spoofed packet,
Allowing the spoofing packet if the MAC information of the spoofing packet is present in the whitelist; And
Blocking the spoofing packet if the MAC information of the spoofing packet is not present in the whitelist.
How to prevent spoofing.
The method of claim 1,
Querying the IP address corresponding to the MAC information of the spoofing packet in the IP-MAC database, and tracking the actual IP address of the spoof.
How to prevent spoofing.
delete The method of claim 1,
Wherein the receiving comprises:
Receiving the one or more information packets from one or more agents installed on the one or more hosts.
How to prevent spoofing.
The method of claim 4, wherein
Wherein the receiving comprises:
Periodically checking by the one or more agents whether the IP address or MAC address of each of the one or more hosts is changed; And
Receiving from the at least one agent one or more information packets containing a changed IP address or a changed MAC address if the IP address or MAC address has changed.
How to prevent spoofing.
An anti-spoofing device comprising one or more agents and controllers installed on one or more hosts,
The one or more agents send one or more information packets including the IP address and MAC address of the one or more hosts to the controller,
The controller,
A construction unit for analyzing the one or more information packets and constructing an IP-MAC database including IP addresses and MAC addresses of the one or more hosts;
A comparison unit comparing the IP information and the MAC information included in the outbound packet transmitted from the host with the IP-MAC database;
A determination unit that determines the outbound packet as a spoofing packet when the IP information and the MAC information of the outbound packet do not match the IP-MAC database; And
Including a filtering unit for filtering the spoofed packet,
The filtering unit,
An allowance unit allowing the spoofing packet when the MAC information of the spoofing packet is present in the white list; And
And a blocking unit to block the spoofing packet when the MAC information of the spoofing packet does not exist in the white list.
Anti-spoofing device.
The method according to claim 6,
The controller,
The IP-MAC database further includes a tracking unit for searching the IP address corresponding to the MAC information of the spoof packet to track the actual IP address of the spoof.
Anti-spoofing device.
delete The method according to claim 6,
Each of the one or more agents,
A checker periodically checking whether an IP address or a MAC address of each of the one or more hosts is changed,
The at least one agent transmits one or more information packets including the changed IP address or the changed MAC address to the controller when the IP address or MAC address is changed.
Anti-spoofing device.
delete delete

Images