WO2008077414A1 - Preventing spoofing - Google Patents
Preventing spoofing Download PDFInfo
- Publication number
- WO2008077414A1 WO2008077414A1 PCT/EP2006/012441 EP2006012441W WO2008077414A1 WO 2008077414 A1 WO2008077414 A1 WO 2008077414A1 EP 2006012441 W EP2006012441 W EP 2006012441W WO 2008077414 A1 WO2008077414 A1 WO 2008077414A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- address
- address information
- mac
- network
- packet
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
Definitions
- the present invention relates to security over a public network, such as the
- Internet for users connected to a shared media access network, such as the Ethernet.
- IP Internet Protocol
- Public Ethernet designates an Ethernet network in which the core network is composed of self-learning switches or nodes forming an aggregated network. Switching through the aggregated network is accomplished using the destination media access control (MAC) address of packets, with each node gradually associating MAC addresses with the associated destination addresses as they receive and redirect packets. This may be accomplished using address resolution protocol (ARP) requests to an edge node or router in the network each time a switch in the aggregate network receives a packet with a new MAC address.
- ARP address resolution protocol
- an access node for connecting at least one subscriber to an Ethernet network.
- the access node has a table for storing address information of the connected subscribers. It also includes a filter module adapted to identify the destination address of data packets received over said network and to permit transmission of the data packets to one of said subscribers only when the packet has a destination address corresponding to the address information stored in said table.
- the access node stores both the IP and MAC addresses assigned to the subscribers. This permits the blocking of traffic routed erroneously on the basis of the MAC address alone within the aggregate network.
- a further level of security is achieved when the filter module is arranged to identify additionally the source address information contained in packets received from one of the subscribers for transmission over the network, and also to permit transmission of these packets onto the network only if the packet source address information corresponds to the address information stored in the table.
- Fig. 1 schematically illustrates a standard Ethernet network with standard Ethernet switches and with access nodes in accordance with the present invention
- Fig. 2 schematically illustrates the functional elements of an access node in accordance with the present invention
- Fig. 3 shows a flow diagram illustrating the filtering function of an access node in accordance with the present invention.
- Fig. 1 illustrates a standard Ethernet network 10 serving, in the present example, as an access network to the Internet or to another external network connected to the Internet.
- the connection to the external network is assured by a router 18, which is connected to the aggregate network made up of standard self-learning Ethernet switches 14, 16.
- the structure and function of the switches 14, 16 of the aggregate network are well known in the art and will not be described further here.
- Two subscribers, User A 20-1 and User B 20-2 are shown connected to the network 10 via access nodes 12-1, 12-2.
- the illustrated subscribers are PCs, however, it will be understood that other devices may constitute subscriber devices.
- Conventional access nodes 12-1, 12-2 include the Fibre Ethernet Access ELN200 manufactured by Ericsson or the ADSL Ethernet modem EDA ESN312 IPDSLAM by Ericsson.
- the access nodes 12-1, 12-2, of the present embodiment may be based on these known devices but include additional functions and features as described hereinafter.
- each access node ANl 12-1, AN2 12-2 is shown with five ports.
- User A 20-1 is shown connected to port 2 of access node ANl 12-1, while User B 20-2 is shown connected to port 5 of access node AN2 12-2.
- ANl 12-1, AN2 12-2 are unoccupied, but it will be understood by those skilled in the art that additional subscribers may be connected to these ports.
- port 1 of each of the access nodes ANl 12-1, AN2 12-2, is connected to a port of an Ethernet switch 14 forming part of the aggregate network. More specifically, access node ANl 12-1 is connected to port 2 of this switch 14, while access node AN2 12-2 is connected to port 3 of the switch. A third port, port 3 of the Ethernet switch 14 is connected to another switch in the aggregate network 16.
- Each of the subscribers User A, 20-1, User B 20-2 connected to the network 10 is assigned an IP-address and a MAC address.
- the IP address is normally defined and communicated by the Internet service provider ISP.
- the MAC address is generally configured in the subscriber network interface card (NIC card) with a unique MAC address being predefined in the factory.
- NIC card subscriber network interface card
- User A 20-1 has a MAC address MAC A and IP address
- IP 1 while User B 20-2 has a MAC address MAC B and IP address IP2.
- the router 18 is also assigned a MAC and IP address, in the present example MAC C and IP 3, respectively.
- Within the aggregate network routing is based only on the MAC addresses contained in a data packet destination address.
- Each switch 14, 16, and access node 12-1, 12-2 holds routing information. This is illustrated in Fig. 1 by the Ethernet routing table 140 associated with Ethernet switch 14, table 120-1 associated with access node 12-1 and table 120-2 associated with access node 12-2, each of which is used by the associated switch or node for forwarding packets to the correct port on the basis of the destination MAC address. This routing information contained in these tables,
- 140, 120-1, 120-2 is gradually accumulated as the switches or nodes "learn" to associate packets with specific MAC addresses with a particular route, based on source address information received in ARP requests, DHCP replies or other packet transmissions. Once this information is present, packets are transmitted through the aggregate network via the shortest path.
- a subscriber may attempt to change his MAC address or IP address even when these are already assigned to another user in order to steal packets from other users. For example a user may transmit packets with a false source MAC or IP address, which will subsequently be assimilated into the routing tables. For example, in Fig. 1 User B 20-2 could change his MAC address from MAC B to MAC A in order to sporadically steal Ethernet packets destined for User A 20-1. While the number of packets that could be highjacked in this way is small, possibly only one in 10,000, this fraudulent use my still be attractive to a malicious subscriber, as over time it is likely that a stolen packet will contain sensitive information, such as a secure password, or the like.
- User B may assume the MAC address of the router 18 by sending a dummy packet from PC B 20-2 with a source address of MAC C. This step would cause the Ethernet switch SWl 14 to alter its routing table to map a packet addressed to MAC C to port 3 instead of port 1 and the access node
- AN2 to change its routing table to map MAC C to port 5. Any packet sent with a destination address MAC C intended for the router 18 within the network 10, for example from PC A 20-1, would then be redirected to PC B 20-2.
- FIG. 2 shows a simplified and schematic representation of a filtering arrangement within the access node 12-2.
- each access node 12 has a filter module 122, which extracts address information from each incoming packet and verifies that the
- IP address corresponds to that of a subscriber connected to the access node 12 by consulting a table 124.
- Table 124 contains the correct - that is, the initially assigned - IP and MAC addresses for each connected subscriber.
- the filter module 122 checks the MAC destination address of all incoming packets against that assigned to the IP address subscriber by referring to the table 124. If these match, the packet is transmitted on to the subscriber; if no match is found, the packet is blocked. In this manner, if a subscriber utilises a different MAC address to the originally assigned address as source address in outgoing packets, as described in the two examples above, these packets will be blocked by the access node.
- the filter function within the access node 12 occurs without the subscriber's knowledge. Fraudulently misdirected packets will simply be blocked at the access node rather than being passed onto the subscriber, as would occur if the Ethernet routing table were used.
- the filter module 22 may also filter outgoing packets to ensure that these contain a valid IP source address. This function serves to prevent subscribers from illegally using the IP address of another user. For example, User B could change the IP source address of packets sent from PC B 20-2 in a TCP/IP request to the Internet from IP B to IP A. The response, although addressed to IP A, that is, the IP address of PC A 20-2, would be routed through the network 10 using the MAC source address that featured in the TPC/IP request, i.e. MAC B, and hence be directed to User B at PC B 20-2. By blocking those packets having a source IP address that does not belong to one of the connected users, or alternatively that does not form a legal pair with the MAC address associated with one of the connected subscribers, the access node prevents the fraudulent or accidental appropriation of packets.
- the filtering of uplink or outgoing packets according to the IP address by an access node is a known feature of some access nodes and is generally incorporated into Public Ethernet networks, to enable all users to be identified by their IP address.
- this known filtering mechanism is combined with the filtering function of the present invention, namely the filtering of incoming packets according to the destination IP and MAC address pair, the security of the network is greatly improved.
- this improved security is achieved without affecting the basic structure of the access network or restricting a bona fide subscriber. For example, a subscriber has no need to submit to a login procedure as would be necessary when the point-to-point protocol (PPPoE) is implemented.
- PPPoE point-to-point protocol
- a network operator has no significant changes to make.
- the filter module 122 receives the next incoming packet.
- the IP and MAC destination address pair is extracted from the packet header.
- these addresses are compared with the entries in filter table 124. If the two addresses are paired in an entry in this table, they represent a legitimate subscriber address. The method then continues to step 104 and the packet is sent to the corresponding port.
- the method passes to step 105 and the packet is blocked.
- the filter table 124 contains only the MAC and IP address of the subscriber User B (PC B, 20-2). The entry thus contains a port number 5, the IP address IP 2 and the MAC address MAC B. Any other combination of IP and MAC address would result in a "No" at step 103 and the method would pass to step 105, with the blocking of the packet.
- step 101 If, at step 101 the packet is received from one of ports 1 to 5, indicating that it has been sent from outside the network 10 by a subscriber, the method passes to step 106, where the IP and MAC source addresses are extracted. Filter table 124 is then consulted at step 107, and if the IP source address, or the combination of IP and MAC source address contained in the packet, does not figure in the table, the method passes to step 105 and the packet is blocked.
- the method proceeds to step 104 with the forwarding of the packet to the correct port as defined in a conventional ARP table (Ethernet routing table) in a known manner.
- the filter function 122 may also signal the event to the network operator by sending an alarm.
- the access node 12 could create a log of the incident for transmission to, or consultation by the access network operator or administrator.
- the filter table 124 may be generated as and when subscribers connect to the access node 12.
- the IP address allocated to each subscriber could be acquired by snooping messages exchanged between the internet service provider (ISP) and the subscriber, such as dynamic host configuration protocol (DHCP) or point-to-point protocol (PPP) messages. Alternatively, if the IP address is configured manually, this may be obtained by interrogating the subscriber or the ISP directly. The MAC address also may be obtained by interrogation.
- ISP internet service provider
- DHCP dynamic host configuration protocol
- PPP point-to-point protocol
- the filter table 124 illustrated in Fig. 2 is shown as a separate entity from the
- Ethernet routing tables 120-1 and 120-2 Ethernet routing tables 120-1 and 120-2.
- the filter table 124 could ultimately be substituted for the routing tables 120-1, 120-2, with the ports defining which addresses are used for the filter function.
- filter table 124 shown in Fig. 2 would be expanded to include information on at least the MAC addresses to be routed via port 1 , while the filter function would operate only on addresses stored in association with ports 2 to 5.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Small-Scale Networks (AREA)
Abstract
In a standard Ethernet access network for accessing the Internet there are no technical security measures preventing users from changing their address information in order to illegally appropriate packets from other users, or simply to disguise their identity. The overall security of the network is improved without compromising the simplicity and speed of transmission over the Ethernet access network by the implementation of a filter mechanism at an access node. This filter mechanism filters out packets destined for subscribers attached to the access node using the allocated IP destination address in conjunction with the allocated MAC address. Any packets directed to a subscriber but containing either the incorrect MAC or IP address is blocked.
Description
PREVENTING SPOOFING
Field of invention The present invention relates to security over a public network, such as the
Internet, for users connected to a shared media access network, such as the Ethernet.
Background art When using the Internet, it is desirable for a user to be identified by a specific
Internet Protocol (IP) address. This helps with the identification of illegal traffic or activities that are a danger to national security, for example. However, if a user is connected to the Internet via a public Ethernet network, the identification of users becomes more difficult, as in a standard network there are no technical barriers against a user changing both his IP-address and
MAC-address, an activity commonly referred to as "spoofing". The term "Public Ethernet" designates an Ethernet network in which the core network is composed of self-learning switches or nodes forming an aggregated network. Switching through the aggregated network is accomplished using the destination media access control (MAC) address of packets, with each node gradually associating MAC addresses with the associated destination addresses as they receive and redirect packets. This may be accomplished using address resolution protocol (ARP) requests to an edge node or router in the network each time a switch in the aggregate network receives a packet with a new MAC address.
It is possible to impose a user identification within an Ethernet access network, wherein each subscriber is required to use a unique username and password to login before being awarded access to the network, such as imposed by the point-to-point protocol PPPoE. However, such systems are
not always appreciated as the need to login each time inevitably slows the access. A further technical solution in such a shared media consists of routing all traffic between all users. However, this is expensive and inefficient. The access nodes must be capable of routing all traffic and each user is effectively assigned at least one IP-subnet, which generally includes four IP-addresses, regardless of the number of IP-addresses required. When such restrictions on the configuration of or routing within the Ethernet access network are not present, security within the network is reliant on mutual trust and on all users following administration rules.
In the light of this prior art, it is thus an object of the present invention to increase the security over an Ethernet access network without imposing restrictions on the configuration or routing within the network itself.
SUMMARY OF THE INVENTION
This and further objects is achieved in an access node for connecting at least one subscriber to an Ethernet network. The access node has a table for storing address information of the connected subscribers. It also includes a filter module adapted to identify the destination address of data packets received over said network and to permit transmission of the data packets to one of said subscribers only when the packet has a destination address corresponding to the address information stored in said table.
Such an arrangement effectively prevents a user from receiving information destined for another user following the transmission by this user of false address information that could cause the aggregate network to divert traffic erroneously away from the genuine destination. However, the network is completely unaffected and traffic may continue to flow via the shortest route through the aggregate network.
Preferably, the access node stores both the IP and MAC addresses assigned to the subscribers. This permits the blocking of traffic routed erroneously on the basis of the MAC address alone within the aggregate network.
A further level of security is achieved when the filter module is arranged to identify additionally the source address information contained in packets received from one of the subscribers for transmission over the network, and also to permit transmission of these packets onto the network only if the packet source address information corresponds to the address information stored in the table.
Any attempt by a user to illicitly utilise a false or duplicate IP address through error or for some malicious purpose is thus prevented.
BRIEF DESCRIPTION OF THE DRAWINGS
Further objects and advantages of the present invention will become apparent from the following description of the preferred embodiments that are given by way of example with reference to the accompanying drawings. In the figures:
Fig. 1 schematically illustrates a standard Ethernet network with standard Ethernet switches and with access nodes in accordance with the present invention,
Fig. 2 schematically illustrates the functional elements of an access node in accordance with the present invention, and
Fig. 3 shows a flow diagram illustrating the filtering function of an access node in accordance with the present invention.
DETAILED DESCRIPTION OF THE DRAWINGS
Fig. 1 illustrates a standard Ethernet network 10 serving, in the present example, as an access network to the Internet or to another external network connected to the Internet. The connection to the external network is assured by a router 18, which is connected to the aggregate network made up of standard self-learning Ethernet switches 14, 16. The structure and function of the switches 14, 16 of the aggregate network are well known in the art and will not be described further here. Two subscribers, User A 20-1 and User B 20-2 are shown connected to the network 10 via access nodes 12-1, 12-2. The illustrated subscribers are PCs, however, it will be understood that other devices may constitute subscriber devices. Conventional access nodes 12-1, 12-2 include the Fibre Ethernet Access ELN200 manufactured by Ericsson or the ADSL Ethernet modem EDA ESN312 IPDSLAM by Ericsson. The access nodes 12-1, 12-2, of the present embodiment may be based on these known devices but include additional functions and features as described hereinafter.
For illustrative purposes, each access node ANl 12-1, AN2 12-2 is shown with five ports. In the present embodiment, User A 20-1 is shown connected to port 2 of access node ANl 12-1, while User B 20-2 is shown connected to port 5 of access node AN2 12-2. The remaining ports of the access nodes
ANl 12-1, AN2 12-2 are unoccupied, but it will be understood by those skilled in the art that additional subscribers may be connected to these ports. In the illustrated arrangement, port 1 of each of the access nodes ANl 12-1, AN2 12-2, is connected to a port of an Ethernet switch 14 forming part of the aggregate network. More specifically, access node ANl 12-1 is connected to port 2 of this switch 14, while access node AN2 12-2 is connected to port 3 of the switch. A third port, port 3 of the Ethernet switch 14 is connected to another switch in the aggregate network 16.
Each of the subscribers User A, 20-1, User B 20-2 connected to the network
10 is assigned an IP-address and a MAC address. The IP address is normally defined and communicated by the Internet service provider ISP. The MAC address is generally configured in the subscriber network interface card (NIC card) with a unique MAC address being predefined in the factory. For illustrative purposes User A 20-1 has a MAC address MAC A and IP address
IP 1, while User B 20-2 has a MAC address MAC B and IP address IP2. The router 18 is also assigned a MAC and IP address, in the present example MAC C and IP 3, respectively. Within the aggregate network routing is based only on the MAC addresses contained in a data packet destination address. Each switch 14, 16, and access node 12-1, 12-2 holds routing information. This is illustrated in Fig. 1 by the Ethernet routing table 140 associated with Ethernet switch 14, table 120-1 associated with access node 12-1 and table 120-2 associated with access node 12-2, each of which is used by the associated switch or node for forwarding packets to the correct port on the basis of the destination MAC address. This routing information contained in these tables,
140, 120-1, 120-2, is gradually accumulated as the switches or nodes "learn" to associate packets with specific MAC addresses with a particular route, based on source address information received in ARP requests, DHCP replies or other packet transmissions. Once this information is present, packets are transmitted through the aggregate network via the shortest path.
However, in such an arrangement a subscriber may attempt to change his MAC address or IP address even when these are already assigned to another user in order to steal packets from other users. For example a user may transmit packets with a false source MAC or IP address, which will subsequently be assimilated into the routing tables. For example, in Fig. 1 User B 20-2 could change his MAC address from MAC B to MAC A in order to sporadically steal Ethernet packets destined for User A 20-1. While the number of packets that could be highjacked in this way is small, possibly only one in 10,000, this fraudulent use my still be attractive to a malicious
subscriber, as over time it is likely that a stolen packet will contain sensitive information, such as a secure password, or the like. This may be achieved as follows: User A sends a TCP/IP request via PC A to the Internet and awaits an answer. User B sends a dummy packet via PC B intended to redirect traffic using the source address as MAC A rather than MAC B. This dummy packet causes the Ethernet switch SWl 14 to change its routing table so that a packet with the destination address MAC A is mapped to port 3 rather than port 2. Similarly, the routing table at access node AN2 12-2 is changed so that a packet with destination address MAC A is mapped to port 5. Following these changes, the reply to the TCP/IP request sent by User A — or any other packet destined for PC A 20-1 - will be redirected to PC B 20-2 and User B. Similarly, User B may assume the MAC address of the router 18 by sending a dummy packet from PC B 20-2 with a source address of MAC C. This step would cause the Ethernet switch SWl 14 to alter its routing table to map a packet addressed to MAC C to port 3 instead of port 1 and the access node
AN2 to change its routing table to map MAC C to port 5. Any packet sent with a destination address MAC C intended for the router 18 within the network 10, for example from PC A 20-1, would then be redirected to PC B 20-2.
In accordance with the present invention, this is prevented by providing a filtering function in the access nodes. Fig. 2 shows a simplified and schematic representation of a filtering arrangement within the access node 12-2. As illustrated in Fig. 2, each access node 12 has a filter module 122, which extracts address information from each incoming packet and verifies that the
IP address corresponds to that of a subscriber connected to the access node 12 by consulting a table 124. Table 124 contains the correct - that is, the initially assigned - IP and MAC addresses for each connected subscriber. The filter module 122 checks the MAC destination address of all incoming packets against that assigned to the IP address subscriber by referring to the table 124.
If these match, the packet is transmitted on to the subscriber; if no match is found, the packet is blocked. In this manner, if a subscriber utilises a different MAC address to the originally assigned address as source address in outgoing packets, as described in the two examples above, these packets will be blocked by the access node.
The filter function within the access node 12 occurs without the subscriber's knowledge. Fraudulently misdirected packets will simply be blocked at the access node rather than being passed onto the subscriber, as would occur if the Ethernet routing table were used.
In addition to filtering incoming or downlink packets on the basis of the destination IP and MAC addresses, the filter module 22 may also filter outgoing packets to ensure that these contain a valid IP source address. This function serves to prevent subscribers from illegally using the IP address of another user. For example, User B could change the IP source address of packets sent from PC B 20-2 in a TCP/IP request to the Internet from IP B to IP A. The response, although addressed to IP A, that is, the IP address of PC A 20-2, would be routed through the network 10 using the MAC source address that featured in the TPC/IP request, i.e. MAC B, and hence be directed to User B at PC B 20-2. By blocking those packets having a source IP address that does not belong to one of the connected users, or alternatively that does not form a legal pair with the MAC address associated with one of the connected subscribers, the access node prevents the fraudulent or accidental appropriation of packets.
The filtering of uplink or outgoing packets according to the IP address by an access node is a known feature of some access nodes and is generally incorporated into Public Ethernet networks, to enable all users to be identified by their IP address. However, when this known filtering mechanism is
combined with the filtering function of the present invention, namely the filtering of incoming packets according to the destination IP and MAC address pair, the security of the network is greatly improved. Moreover, this improved security is achieved without affecting the basic structure of the access network or restricting a bona fide subscriber. For example, a subscriber has no need to submit to a login procedure as would be necessary when the point-to-point protocol (PPPoE) is implemented. A network operator has no significant changes to make.
The function of the filtering mechanism within an access node 12 is illustrated in a flow diagram in Fig. 3. Starting at event 100, the filter module 122 receives the next incoming packet. At step 101 it is determined at which port the packet was received. If it was received at port 1, and thus represents a packet received from network 10, the method continues to step 102. At this third step, the IP and MAC destination address pair is extracted from the packet header. At step 103, these addresses are compared with the entries in filter table 124. If the two addresses are paired in an entry in this table, they represent a legitimate subscriber address. The method then continues to step 104 and the packet is sent to the corresponding port. If, on the other hand, the extracted IP and MAC destination address pair are not contained in an entry in table 124, the method passes to step 105 and the packet is blocked. In the case of the access node AN2 12-2, the filter table 124 contains only the MAC and IP address of the subscriber User B (PC B, 20-2). The entry thus contains a port number 5, the IP address IP 2 and the MAC address MAC B. Any other combination of IP and MAC address would result in a "No" at step 103 and the method would pass to step 105, with the blocking of the packet. If, at step 101 the packet is received from one of ports 1 to 5, indicating that it has been sent from outside the network 10 by a subscriber, the method passes to step 106, where the IP and MAC source addresses are extracted. Filter table 124 is then consulted at step 107, and if the IP source address, or the combination
of IP and MAC source address contained in the packet, does not figure in the table, the method passes to step 105 and the packet is blocked. This would indicate that a subscriber has illegally modified at least the allocated IP source address in the packet If, on the other hand, the IP source address, or IP and MAC source address combination, is found in the table at step 107, the method proceeds to step 104 with the forwarding of the packet to the correct port as defined in a conventional ARP table (Ethernet routing table) in a known manner. In addition to blocking an unauthorised packet, the filter function 122 may also signal the event to the network operator by sending an alarm. In addition the access node 12 could create a log of the incident for transmission to, or consultation by the access network operator or administrator. The increased highjacking of a neighbours traffic by using a false MAC address, while potentially representing a security risk, will also impact on the amount of traffic present on the access network, as misdirected packets will inevitably be resent. Consequently the quality of service that can be provided by the network will be degraded. If a network operator is alerted to the problem, steps can be taken to block the fraudulent subscriber, for example by disconnection of his port.
The filter table 124 may be generated as and when subscribers connect to the access node 12. The IP address allocated to each subscriber could be acquired by snooping messages exchanged between the internet service provider (ISP) and the subscriber, such as dynamic host configuration protocol (DHCP) or point-to-point protocol (PPP) messages. Alternatively, if the IP address is configured manually, this may be obtained by interrogating the subscriber or the ISP directly. The MAC address also may be obtained by interrogation.
The filter table 124 illustrated in Fig. 2 is shown as a separate entity from the
Ethernet routing tables 120-1 and 120-2. However, it will be understood that the filter table 124 could ultimately be substituted for the routing tables 120-1,
120-2, with the ports defining which addresses are used for the filter function. For example, filter table 124 shown in Fig. 2 would be expanded to include information on at least the MAC addresses to be routed via port 1 , while the filter function would operate only on addresses stored in association with ports 2 to 5.
Claims
1. An access node for connecting at least one subscriber to an Ethernet network, said access node including a storage module (124) for storing address information of said subscribers, further characterised by a filter module (122) adapted to identify the destination address of data packets received over said network (10) and to permit the transmission to one of said subscribers only of those data packets having a destination address corresponding to the address information stored in said storage module (124).
2. An access node as claimed in claim 1, wherein said storage module (124) is adapted to store an Internet Protocol address in association with a Media
Access control address for each subscriber and said filter module is adapted to extract an IP destination address and a MAC destination address from said received packet and to compare said extracted destination addresses with said stored address information.
3. An access node as claimed in claim 1 or 2, wherein said filter module (122) is further adapted to identify the source address information contained in packets received from one of said subscribers for transmission over said network (10) and to permit transmission of said packets onto said network only if the packet source address information corresponds to the address information stored in said storage module (124).
4. An access node as claimed in claim 3, wherein said storage module (124) is adapted to store an Internet Protocol address in association with a Media Access control address for each subscriber said wherein said filter module (122) is further adapted to extract the IP source address and MAC source address of packets received from said subscribers and to compare said extracted source addresses with said stored address information.
5. An access node as claimed in any previous claim, wherein said filter module is further adapted to generate an alarm signal when said identified address information does not correspond with said stored address information.
6. A method of filtering packets at an access node for connecting subscribers to an Ethernet access network, said method including the steps of: receiving a packet over said access network, extracting destination address information contained in said packet, comparing said extracted destination address information with address information stored for each subscriber in a storage module (124), and transmitting said packet to one of said subscribers only if the address information is contained in said storage module (124).
7. A method as claimed in claim 6, wherein said step of extracting destination address information includes extracting a destination IP address and MAC address pair from said packet and wherein said comparison step includes comparing the extracted IP and MAC destination address pair with IP and MAC address pairs stored in said storage module (124).
8. A method as claimed in claim 6 or 7, further including the steps of: receiving a packet from one of said subscribers destined for transmission over said Ethernet network (10), extracting source address information from said packet, comparing said extracted source address information with said address information stored for each subscriber in said storage module, and transmitting said packet onto said Ethernet network only if the extracted address information is contained in said storage module.
9. A method as claimed in claim 8, wherein said step of extracting source address information includes the step of extracting at least the IP source address of said packets and wherein said step of comparing includes comparing at least said extracted IP source address with IP addresses stored for each subscriber.
10. A method as claimed in claim 9, wherein said step of extracting source address information includes the step of extracting also the MAC source address of packets and said step of comparing includes comparing said extracted IP source address and MAC source address pair with IP and MAC source addresses stored for each subscriber.
11. A method as claimed in any one of claims 6 to 10, further including the step of generating an alarm signal when said extracted address information does not correspond with said stored address information.
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/EP2006/012441 WO2008077414A1 (en) | 2006-12-22 | 2006-12-22 | Preventing spoofing |
EP06829833A EP2103075A1 (en) | 2006-12-22 | 2006-12-22 | Preventing spoofing |
CN200680056732.6A CN101641933A (en) | 2006-12-22 | 2006-12-22 | Preventing of electronic deception |
US12/520,275 US8966608B2 (en) | 2006-12-22 | 2006-12-22 | Preventing spoofing |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/EP2006/012441 WO2008077414A1 (en) | 2006-12-22 | 2006-12-22 | Preventing spoofing |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2008077414A1 true WO2008077414A1 (en) | 2008-07-03 |
Family
ID=38627145
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/EP2006/012441 WO2008077414A1 (en) | 2006-12-22 | 2006-12-22 | Preventing spoofing |
Country Status (4)
Country | Link |
---|---|
US (1) | US8966608B2 (en) |
EP (1) | EP2103075A1 (en) |
CN (1) | CN101641933A (en) |
WO (1) | WO2008077414A1 (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101662480B (en) * | 2009-09-01 | 2012-03-07 | 卡斯柯信号有限公司 | Log system based on access control |
EP2530881A1 (en) * | 2011-06-27 | 2012-12-05 | Huawei Technologies Co., Ltd. | Media access control address protection method and switch |
CN110798391A (en) * | 2018-08-01 | 2020-02-14 | 株式会社日立制作所 | Network relay device, network relay method, and network relay program |
Families Citing this family (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2009031453A1 (en) * | 2007-09-07 | 2009-03-12 | Cyber Solutions Inc. | Network security monitor apparatus and network security monitor system |
US20100312922A1 (en) * | 2009-06-09 | 2010-12-09 | Quantum Corporation | System and method for identifying physical location of ethernet-connected media drives in a media library assembly |
US8341725B2 (en) * | 2009-07-30 | 2012-12-25 | Calix, Inc. | Secure DHCP processing for layer two access networks |
CN101895587B (en) * | 2010-07-06 | 2015-09-16 | 中兴通讯股份有限公司 | Prevent the methods, devices and systems of users from modifying IP addresses privately |
US8972554B2 (en) * | 2010-09-30 | 2015-03-03 | The Nielsen Company (Us), Llc | Methods and apparatus to measure mobile broadband market share |
CN102316034B (en) * | 2011-09-06 | 2017-05-10 | 中兴通讯股份有限公司 | Method for preventing manual Internet protocol (IP) address specification in local area network and device |
WO2013115807A1 (en) * | 2012-01-31 | 2013-08-08 | Hewlett-Packard Development Company, L.P. | Determination of spoofing of a unique machine identifier |
WO2014075716A1 (en) * | 2012-11-14 | 2014-05-22 | Telefonaktiebolaget L M Ericsson (Publ) | Content based overload protection |
JP6041636B2 (en) * | 2012-11-26 | 2016-12-14 | キヤノン株式会社 | Information processing apparatus, information processing apparatus control method, and program |
US9634948B2 (en) * | 2013-11-07 | 2017-04-25 | International Business Machines Corporation | Management of addresses in virtual machines |
WO2015106461A1 (en) * | 2014-01-20 | 2015-07-23 | 华为技术有限公司 | Address obtaining method and network virtualization edge device |
US20180176181A1 (en) * | 2016-12-19 | 2018-06-21 | Cisco Technology, Inc. | Endpoint admission control |
US10567379B2 (en) * | 2017-06-26 | 2020-02-18 | Bank Of America Corporation | Network switch port access control and information security |
US10567433B2 (en) * | 2017-07-06 | 2020-02-18 | Bank Of America Corporation | Network device authorization for access control and information security |
US11277442B2 (en) * | 2019-04-05 | 2022-03-15 | Cisco Technology, Inc. | Verifying the trust-worthiness of ARP senders and receivers using attestation-based methods |
CN112003850A (en) * | 2020-08-14 | 2020-11-27 | 北京浪潮数据技术有限公司 | Flow monitoring method, device, equipment and storage medium based on cloud network |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2003223307A (en) * | 2002-01-31 | 2003-08-08 | Canon Inc | Access limiter, access limiting method, its program and storage medium |
US20050125692A1 (en) * | 2003-12-04 | 2005-06-09 | Cox Brian F. | 802.1X authentication technique for shared media |
US20060155853A1 (en) * | 2002-11-06 | 2006-07-13 | Peter Nesz | Method and arrangement for preventing illegitimate use of ip addresses |
US20060209818A1 (en) * | 2005-03-18 | 2006-09-21 | Purser Jimmy R | Methods and devices for preventing ARP cache poisoning |
WO2006099303A1 (en) * | 2005-03-11 | 2006-09-21 | Tracesecurity, Inc. | Integrated, rules-based security compliance and gateway system |
Family Cites Families (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5615340A (en) * | 1994-07-21 | 1997-03-25 | Allied Telesyn Int'l Corp. | Network interfacing apparatus and method using repeater and cascade interface with scrambling |
US5581559A (en) * | 1995-03-17 | 1996-12-03 | Advanced Micro Devices, Inc. | Inverse packet disrupt for secure networks |
ATE252298T1 (en) * | 1999-11-16 | 2003-11-15 | Broadcom Corp | METHOD AND NETWORK SWITCH WITH DATA SERIALIZATION THROUGH HAZARD-FREE MULTI-STEP, ERROR-FREE MULTIPLEXATION |
US20020133586A1 (en) * | 2001-01-16 | 2002-09-19 | Carter Shanklin | Method and device for monitoring data traffic and preventing unauthorized access to a network |
JP4647825B2 (en) * | 2001-04-27 | 2011-03-09 | 富士通セミコンダクター株式会社 | Packet transmission / reception system, host, and program |
US7370356B1 (en) * | 2002-01-23 | 2008-05-06 | Symantec Corporation | Distributed network monitoring system and method |
US6990592B2 (en) * | 2002-02-08 | 2006-01-24 | Enterasys Networks, Inc. | Controlling concurrent usage of network resources by multiple users at an entry point to a communications network based on identities of the users |
JP3834280B2 (en) * | 2002-10-01 | 2006-10-18 | Necインフロンティア株式会社 | Terminal device, priority processing method in terminal device, and program |
US7379423B1 (en) * | 2003-03-20 | 2008-05-27 | Occam Networks, Inc. | Filtering subscriber traffic to prevent denial-of-service attacks |
US20040240447A1 (en) * | 2003-05-28 | 2004-12-02 | Dorbolo Riccardo G. | Method and system for identifying bidirectional packet flow |
US7913294B1 (en) * | 2003-06-24 | 2011-03-22 | Nvidia Corporation | Network protocol processing for filtering packets |
US7499450B2 (en) * | 2004-04-30 | 2009-03-03 | Infineon Technologies Ag | Router IP port for an IP router |
US7797738B1 (en) * | 2005-12-14 | 2010-09-14 | At&T Corp. | System and method for avoiding and mitigating a DDoS attack |
-
2006
- 2006-12-22 EP EP06829833A patent/EP2103075A1/en not_active Withdrawn
- 2006-12-22 CN CN200680056732.6A patent/CN101641933A/en active Pending
- 2006-12-22 WO PCT/EP2006/012441 patent/WO2008077414A1/en active Application Filing
- 2006-12-22 US US12/520,275 patent/US8966608B2/en active Active
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2003223307A (en) * | 2002-01-31 | 2003-08-08 | Canon Inc | Access limiter, access limiting method, its program and storage medium |
US20060155853A1 (en) * | 2002-11-06 | 2006-07-13 | Peter Nesz | Method and arrangement for preventing illegitimate use of ip addresses |
US20050125692A1 (en) * | 2003-12-04 | 2005-06-09 | Cox Brian F. | 802.1X authentication technique for shared media |
WO2006099303A1 (en) * | 2005-03-11 | 2006-09-21 | Tracesecurity, Inc. | Integrated, rules-based security compliance and gateway system |
US20060209818A1 (en) * | 2005-03-18 | 2006-09-21 | Purser Jimmy R | Methods and devices for preventing ARP cache poisoning |
Non-Patent Citations (1)
Title |
---|
See also references of EP2103075A1 * |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101662480B (en) * | 2009-09-01 | 2012-03-07 | 卡斯柯信号有限公司 | Log system based on access control |
EP2530881A1 (en) * | 2011-06-27 | 2012-12-05 | Huawei Technologies Co., Ltd. | Media access control address protection method and switch |
EP2530881A4 (en) * | 2011-06-27 | 2013-01-23 | Huawei Tech Co Ltd | Media access control address protection method and switch |
US9282025B2 (en) | 2011-06-27 | 2016-03-08 | Huawei Technologies Co., Ltd. | Medium access control address protection method and switch |
CN110798391A (en) * | 2018-08-01 | 2020-02-14 | 株式会社日立制作所 | Network relay device, network relay method, and network relay program |
CN110798391B (en) * | 2018-08-01 | 2021-12-21 | 株式会社日立制作所 | Network relay device, network relay method, and network relay program |
Also Published As
Publication number | Publication date |
---|---|
EP2103075A1 (en) | 2009-09-23 |
US8966608B2 (en) | 2015-02-24 |
CN101641933A (en) | 2010-02-03 |
US20110010769A1 (en) | 2011-01-13 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8966608B2 (en) | Preventing spoofing | |
US7234163B1 (en) | Method and apparatus for preventing spoofing of network addresses | |
US7379423B1 (en) | Filtering subscriber traffic to prevent denial-of-service attacks | |
US7167922B2 (en) | Method and apparatus for providing automatic ingress filtering | |
US20100333191A1 (en) | System and method for protecting cpu against remote access attacks | |
US7570625B1 (en) | Detection of wireless devices | |
RU2006143768A (en) | AROMATIC RESTRICTION OF THE NETWORK VIOLENT | |
Hijazi et al. | Address resolution protocol spoofing attacks and security approaches: A survey | |
WO2015174100A1 (en) | Packet transfer device, packet transfer system, and packet transfer method | |
CN101459653B (en) | Method for preventing DHCP packet attack based on Snooping technique | |
WO2005026872A2 (en) | Internal lan perimeter security appliance composed of a pci card and complementary software | |
Singh et al. | A detailed survey of ARP poisoning detection and mitigation techniques | |
CN114710388B (en) | Campus network security system and network monitoring system | |
RU2684575C1 (en) | METHOD FOR CONTROL OF DISTRIBUTED INFORMATION SYSTEM DATA STREAMS IN DDoS ATTACKS | |
Wang et al. | Enhanced intranet management in a DHCP-enabled environment | |
Cisco | Configuring Network Security | |
US8347075B1 (en) | Methods to mitigate attacks against fiber-to-the-home network systems | |
CN104917751B (en) | Electronic deception prevents | |
KR102184757B1 (en) | Network hidden system and method | |
KR100516971B1 (en) | Method and system for user certification in dynamic host configuration protocol network | |
Arslan | A solution for ARP spoofing: Layer-2 MAC and protocol filtering and arpserver | |
KR101871146B1 (en) | Network switch apparatus for blocking an unauthorized terminal and Blocking method for the unauthorized terminal | |
KR100954348B1 (en) | Packet monitoring system and method thereof | |
El-Taj et al. | Network sniffing and its consequences: a comprehensive survey | |
JP2004032134A (en) | Communication monitoring system |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
WWE | Wipo information: entry into national phase |
Ref document number: 200680056732.6 Country of ref document: CN |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 06829833 Country of ref document: EP Kind code of ref document: A1 |
|
DPE1 | Request for preliminary examination filed after expiration of 19th month from priority date (pct application filed from 20040101) | ||
NENP | Non-entry into the national phase |
Ref country code: DE |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2006829833 Country of ref document: EP |
|
DPE1 | Request for preliminary examination filed after expiration of 19th month from priority date (pct application filed from 20040101) | ||
WWE | Wipo information: entry into national phase |
Ref document number: 12520275 Country of ref document: US |