KR20090040593A - Server for dynamic host configuration protocol - Google Patents

Abstract

A server for a dynamic host configuration protocol is provided to secure a service of an authorized IP user by passing an ARP packet during a predetermined period. A management unit includes in a DHCP(Dynamic Host Configuration Protocol) processor(400) records a hardware address, an IP address, a lease time, etc. of an IP(Internet Protocol) address to a DHCP list DB(402) according to a DHCP. The management unit records the IP address and the hardware address includes the HDCP lease DB to a secure ARP table(404), and a filtering unit(412) includes in the DHCP processor passes an ARP packet during a predetermined period. In addition, the filtering unit passes or abolishes the ARP packet based on the secure ARP table during the rest period.

Description

Dynamic Host Configuration Protocol server {server for Dynamic Host Configuration Protocol}

1 illustrates a process of assigning an IP by a DHCP server and generating a secure ARP table used for static IP blocking.

2 is a flowchart illustrating an operation of a DHCP server for blocking static IP users.

3 illustrates a process in which a normal IP user cannot perform communication due to restart of a DHCP server.

4 is a block diagram showing the configuration of a DHCP server according to an embodiment of the present invention.

5 is a flowchart illustrating the operation of a DHCP server according to an embodiment of the present invention.

6 is a diagram illustrating the operation of the DHCP server according to the present invention in a time flow when a restart of the DHCP server occurs.

The present invention relates to a DHCP server, and more particularly, to a DHCP server that can guarantee the service of a normal IP user even if the DHCP server is rebooted or the daemon is restarted. .

Personal computers (PCs) around the world are connected to the Internet through network equipment consisting of routers and switches. Each PC is connected to the Internet through a network device consisting of a router and a switch. Basically, since the Internet is based on a protocol combination called Transmission Control Protocol / Internet Protocol (hereinafter referred to as "TCP / IP"), the PC has a unique IP address to access the Internet. There is a need. Ideally, all PCs will have a fixed, unique IP address, but since IP address resources are limited and manual entry of their IP address on each PC is cumbersome, most PCs use DHCP each time they connect to the Internet. IP address is assigned dynamically. Therefore, a host such as a PC is equipped with a DHCP client program and receives an IP address from a network device equipped with a DHCP server program and uses it for a predetermined lease time. In addition, the DHCP server supports the ability to block static IP users to avoid wasting limited IP address resources.

FIG. 1 illustrates a process in which a DHCP server allocates an IP and a process of generating a secure ARP table used for static IP blocking.

Referring to FIG. 1, when a client broadcasts a DHCP discovery packet in order to be assigned an IP address, a DHCP offer packet including an IP address and lease time to be allocated by a DHCP server receiving the packet is provided. Send to the client. The client receiving the DHCP offer packet broadcasts a DHCP request packet to use the corresponding IP address. Upon receiving this, the DHCP server records the client's hardware address (for example, MAC address in case of Ethernet), assigned IP address, lease time, and user ID in the DHCP lease DB (Secure ARP). After recording the client's hardware address and the assigned IP address in the table, a DHCP acknowledgment (ACK) packet is sent to the client to allow the use of the IP address.

Later, after half of the lease time, the client sends a DHCP request packet to the DHCP server to extend the use of the IP address. Upon receiving this, the DHCP server updates the lease time of the corresponding IP address and reflects it in the DHCP lease DB.

Meanwhile, the secure ARP in which the hardware address and the IP address in the DHCP lease DB are registered is used for fixed IP blocking, which will be described later with reference to FIG. 2.

2 is a flowchart illustrating an operation of a DHCP server for blocking static IP users.

Referring to FIG. 2, when an ARP packet is received, the DHCP server determines whether to set a fixed IP blocking function. In this specification, an ARP packet is used as a term encompassing an ARP request packet and an ARP reply packet.

If static IP user blocking is disabled, the DHCP server passes the received ARP packets. On the other hand, if the fixed IP blocking function is enabled (enable), it is checked whether the source hardware address and the source IP address of the received ARP packet matches the entry in the secure table. In other words, the DHCP server checks whether the host sending the ARP packet is assigned an IP address from the DHCP server. As a result of the check, if there is no match, the received ARP packet is dropped, and if matched, the received ARP packet is passed. For only ARP packets that are passed, the source hardware address and source IP address of the ARP packets are registered in the ARP table, and the DHCP server generates an ARP reply packet that responds if the ARP packets passed are ARP request packets, Send to the client. As a result, communication is blocked for a host not registered in the secure ARP table, that is, a host not assigned an IP address from a DHCP server (that is, a fixed IP user).

On the other hand, if the DHCP server restarts or restarts the daemon, all entries in the DHCP lease DB and secure ARP table are deleted. In this case, due to the above-described fixed IP blocking operation, a situation in which hosts normally assigned an IP address from a DHCP server cannot communicate, as shown in FIG. 3.

3 illustrates a process in which a normal IP user cannot perform communication due to restart of a DHCP server.

In Fig. 3, all entries are deleted from the DHCP lease DB of the DHCP server and the secure ARP table in which the information of the host assigned the IP address is contained as an entry, due to the restart of the DHCP server. On the other hand, when information related to the DHCP server (hardware address, IP address, etc.) is aged out and deleted from the host's ARP table, the client broadcasts an ARP request packet and the DHCP server receives it. At this time, if all entries in the secure ARP table are deleted due to the restart of the DHCP server, as described in FIG. 2, since there is no entry in the secure ARP table that matches, the DHCP server discards the received ARP request packet. That is, even an ARP request packet transmitted from a host of a normal IP user is discarded due to a restart of the DHCP server. As a result, even a normal IP user cannot temporarily perform communication properly.

Therefore, in a DHCP server performing fixed IP user blocking, even if a secure ARP table or the like is deleted by restarting or restarting a daemon, a method for ensuring communication of a normal IP user is required.

The technical problem to be achieved by the present invention is to provide a DHCP server that can guarantee the service of a normal IP user even if a situation such as restart, daemon restart.

In order to achieve the above technical problem, a first aspect of the present invention provides a management unit for managing information including a hardware address and an IP address of each host to which an IP address is assigned; And a filtering unit which passes the ARP packet for a predetermined period and passes or discards the ARP packet based on the information for the remaining period.

In order to achieve the above technical problem, a second aspect of the present invention provides a management unit for managing a secure ARP table; And a synchronization unit for deleting an entry not present in the secure ARP table from the ARP table after a predetermined period of time has elapsed.

Hereinafter, embodiments of the present invention for solving the above technical problem are described with reference to the accompanying drawings. In describing the present embodiment, the same name and the same reference numerals are used for the same configuration and additional description thereof will be omitted below.

4 is a block diagram showing the configuration of a DHCP server according to an embodiment of the present invention. Referring to FIG. 4, the DHCP server includes a DHCP processor 400, a DHCP lease DB 402, a secure ARP table 404, an ARP processor 410, and an ARP table 420. For reference, FIG. 4 is only a schematic view illustrating a configuration of a DHCP server to explain the concept of the present invention. The scope of the present invention may be changed by adding other modules or modifying the structure according to implementation. Without being limited to the example shown in FIG. 4, those skilled in the art can fully understand.

The DHCP processing unit 400 receives the DHCP discovery packet and the DHCP request packet, transmits the DHCP providing packet and the DHCP accept packet, and manages the DHCP lease DB 402 and the secure ARP table 404. That is, the management unit (not shown) included in the DHCP processing unit 400 records the hardware address, IP address, lease time, etc. of the host assigned the IP address according to DHCP in the DHCP lease DB 402, and the DHCP lease DB ( The IP address and hardware address included in 402 are recorded in the secure ARP table 404.

The ARP processing unit 410 filters the received ARP packet and registers the corresponding information of the ARP packet passed in the ARP table 420. If the passed ARP packet is an ARP request packet, the ARP processor 410 generates an ARP response packet and transmits it to the host. . Referring to FIG. 4, the ARP processing unit 410 includes a filtering unit 412, a synchronization unit 414, a registration unit 416, and a response unit 418.

The filtering unit 412 that performs packet verification passes the ARP packet for a predetermined period (hereinafter, referred to as a grace period), and passes or discards the ARP packet based on the secure ARP table 404 for the remaining period. Preferably, the grace period includes a period from when all entries of the DHCP lease DB 402 and the secure ARP table 404 are deleted due to restart, daemon restart, and the like, to a predetermined time elapsed. An example of the predetermined time may be more than half of the DHCP lease time to ensure that a DHCP request packet for extending the use of an IP address is received.

After the grace period elapses, the synchronization unit 414 deletes an entry that does not match the secure ARP table from the ARP table.

The registration unit 416 registers the source IP address and the source hardware address of the ARP packet passed by the filtering unit 412 in the ARP table 420.

The response unit 418 generates an ARP response packet that responds to the ARP request packet passed by the filtering unit 412, and transmits the ARP response packet to the host that sent the ARP request packet.

5 is a flowchart illustrating the operation of a DHCP server according to an embodiment of the present invention. Referring to FIG. 4, the embodiment of FIG. 5 will be described below.

When the ARP packet is received (S500), the filtering unit 412 determines whether the fixed IP user blocking function is activated (S510).

If the fixed IP user blocking function is disabled (S510), the filtering unit 412 passes the received ARP packet without packet verification (S550). As a result, the source IP address and the source hardware address of the passed ARP packet are registered in the ARP table 420 by the registration unit 416, and if the passed ARP packet is an ARP request packet, an ARP response packet responding thereto is responded. Subsequent processing generated by section 418 and sent to the host that sent the ARP request packet is performed.

If the fixed IP user blocking function is activated (S510), the filtering unit 412 determines whether the reception time of the ARP packet is within the grace period (S520). If it is within the grace period (S520), the filtering unit 412 passes the received ARP packet without packet verification (S550), and similarly the subsequent processing described above is performed. Thus, normal IP user communication is guaranteed even during the grace period.

If it is out of the grace period (S520), the process proceeds to step S530 where a packet verification process is performed. If there is an entry of the secure ARP table 404 that matches both the source hardware address and the source IP address of the received ARP packet (S530), the filtering unit 412 passes the received ARP packet (S550), and similarly described above. One subsequent processing is performed.

If there is no entry in the secure ARP table 404 that matches both the source hardware address and the source IP address of the received ARP packet (S530), the filtering unit 412 discards the received ARP packet (S540). As a result, the communication of the fixed IP user is blocked.

6 is a diagram illustrating the operation of the DHCP server according to the present invention in a time flow when a restart of the DHCP server occurs.

In Fig. 6, all entries are deleted from the DHCP lease DB of the DHCP server and the secure ARP table in which the information of the host assigned the IP address is contained as an entry, due to the restart of the DHCP server. Thereafter, the host having the ARP table deleted by aging out the information related to the DHCP server (hardware address, IP address, etc.), broadcasts an ARP request packet, which is received by the DHCP server. Since the reception time of the request packet is within the grace period, the ARP request packet is passed without packet verification and registered in the ARP table. That is, during the grace period, unlike in FIG. 3, all ARP request packets are passed to perform the subsequent processing described above.

In addition, during the grace period, each host sends a DHCP request packet to the DHCP server. As a result, the DHCP server allows the extension of the IP address and registers the related contents in the DHCP lease DB and the secure ARP table.

Immediately after the grace period, the above-described synchronization process (the process of deleting an entry not matching the secure ARP table from the ARP table) is performed.

For the ARP packet received after the grace period has passed, the above-described secure ARP table based verification is performed. That is, ARP packets that do not match the secure ARP table are discarded, and ARP packets that match the secure ARP table are passed to transmit the ARP response packet (when the passed ARP packet is an ARP request packet), and the registration process of the ARP table is performed. Is performed.

The present invention can also be embodied as machine-readable code on a machine-readable recording medium such as a computer. Here, an example of a machine is an apparatus capable of performing two-layer switching. The machine-readable recording medium includes all kinds of recording devices that store data that can be read by the machine. Examples of machine-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which are also implemented in the form of carrier waves (for example, transmission over the Internet). Include. The machine-readable recording medium can also be distributed over network coupled machine systems so that the machine-readable code is stored and executed in a distributed fashion. In addition, functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers in the art to which the present invention belongs.

Such a method and apparatus of the present invention have been described with reference to the embodiments shown in the drawings for clarity, but these are merely exemplary, and various modifications and equivalent other embodiments are possible to those skilled in the art. Will understand. Therefore, the true technical protection scope of the present invention will be defined by the appended claims.

According to the present invention, even if a situation such as re-booting or daemon restart occurs in the DHCP server, the service of a normal IP user can be guaranteed.

Claims (9)

A management unit for managing information including a hardware address and an IP address of each host to which the IP address is assigned; And And a filtering unit for passing the ARP packet for a predetermined period and passing or discarding the ARP packet based on the information for the remaining period. The method of claim 1, wherein the predetermined period of time And a period of time from when all of the information is deleted until a predetermined time elapses. The method of claim 2, wherein the predetermined time DHCP server, characterized in that more than half of the DHCP lease time. According to any one of claims 1 to 3, wherein the management unit DHCP server, characterized in that for managing the information contained in the secure ARP table. The method of claim 4, wherein And a synchronization unit for deleting an entry that does not match the secure table from the ARP table after the predetermined period has elapsed. The method according to any one of claims 1 to 3, And a register configured to register a source IP address and a source hardware address of the passed ARP packet in an ARP table. The method according to any one of claims 1 to 3, And a response unit for generating an ARP response packet in response to the ARP request packet if the passed ARP packet is an ARP request packet. A management unit managing a secure ARP table; And And a synchronization unit for deleting an entry not included in the secure ARP table from the ARP table after a predetermined period has elapsed. The method of claim 8, wherein the predetermined period of time DHCP server, characterized in that for passing the ARP packet, without verifying the ARP packet.

Images