A method and system for preventing dhcp spoofing

Abstract

The application discloses a method and system for preventing DHCP spoofing, which comprises the following steps: firstly, obtaining a DHCP packet based on a controller, and extracting a source MAC address according to the obtained DHCP packet; secondly, judging whether the source MAC address matches a MAC address in a DHCP Snooping binding table; if yes, setting an uplink port as a trusted port; if no, deleting the DHCP packet, and marking a source MAC address corresponding to the DHCP packet with a discarded time number as 1; finally, judging whether the discarded time number of the source MAC address corresponding to the DHCP packet is greater than N; if yes, listing the source MAC address in a blacklist; if no, ending the process.

Description

Technical Field

[0001] This invention relates to the field of network communication, and more specifically to a method and system for preventing DHCP spoofing. Background Technology

[0002] Industry 4.0 is a high-tech strategic plan proposed by the German government, aiming to improve the intelligence level of manufacturing and establish smart factories with adaptability, resource efficiency, and human factors engineering. Its technological foundation is cyber-physical systems and the Internet of Things (IoT). Some domestic enterprises have already begun to focus on promoting the construction of industrial internet platforms. The main steps generally include completing the construction of the industrial infrastructure network in research and assembly plants to meet the information interaction needs of the core machine assembly intelligent manufacturing integration platform, realizing the cyber-physical fusion of core machine assembly, and building an industrial infrastructure network based on the core machine intelligent assembly unit as the core and highly collaborative intelligent logistics warehousing, manufacturing execution, real-time data center, and other systems. The construction content includes: industrial infrastructure network construction, industrial network equipment management platform construction, industrial WiFi construction, security isolation and information transmission system construction, and workshop material positioning system construction, etc.

[0003] In industrial infrastructure network construction, network security is particularly important. Network security refers to the protection of network system hardware, software, and data from accidental or malicious damage, alteration, or disclosure, ensuring continuous, reliable, and normal system operation and uninterrupted network service. DHCP spoofing is a man-in-the-middle attack. Using a DHCP server can automatically set network parameters such as IP address, subnet mask, gateway, DNS, and WINS for users, simplifying network settings and improving management efficiency. However, there are also some problems in the management and use of DHCP servers that network administrators may encounter. Common issues include: DHCP server impersonation; DHCP server DoS attacks; some users arbitrarily assigning addresses, causing network address conflicts; due to the DHCP operating mechanism, there is usually no authentication mechanism between the server and the client, and the presence of multiple DHCP servers on the network can cause chaos; network chaos caused by accidentally configuring a DHCP server is also very common. Summary of the Invention

[0004] The following provides a brief overview of one or more aspects to offer a basic understanding of them. This overview is not an exhaustive summary of all conceived aspects, nor is it intended to identify key or decisive elements of all aspects, nor to define the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form to prepare for the more detailed descriptions that follow.

[0005] The purpose of this invention is to solve the above-mentioned problems and provide a method and system for preventing DHCP spoofing, which can effectively prevent DHCP spoofing attacks, ensure network security, and prevent malicious damage to the hardware, software and data of the network system.

[0006] The technical solution of this invention is as follows:

[0007] This invention provides a method for preventing DHCP spoofing, comprising the following steps:

[0008] Step S1: Obtain DHCP packets based on the controller, and extract the source MAC address based on the obtained DHCP packets;

[0009] Step S2: Determine if the source MAC address matches the MAC address in the DHCP Snooping binding table; if yes, set the uplink port as a trusted port; if no, proceed to the next step S3.

[0010] Step S3: Delete the DHCP packet and increment the drop count of the source MAC address corresponding to the DHCP packet by 1;

[0011] Step S4: Determine whether the number of times the source MAC address corresponding to the DHCP packet has been dropped is greater than the preset maximum value N; if yes, add the source MAC address to the blacklist; if no, end the process.

[0012] According to one embodiment of the method for preventing DHCP spoofing of the present invention, before performing source MAC address matching, the method further determines whether the extracted source MAC address is included in a blacklist; if so, it is directly deleted; if not, source MAC address matching is performed.

[0013] According to one embodiment of the method for preventing DHCP spoofing of the present invention, the method establishes a DHCP Snooping binding table based on dynamic address allocation and adds a list of trusted server IP addresses to the DHCP Snooping binding table, thereby matching the source MAC address of DHCP packets through the DHCP Snooping binding table.

[0014] According to one embodiment of the method for preventing DHCP spoofing according to the present invention, in step S2, if the source MAC address does not match the MAC address in the DHCPSnooping binding table, the uplink port is set as an untrusted port, thereby intercepting and sniffing DHCP messages from the untrusted port and discarding abnormal DHCP response messages from the untrusted port.

[0015] This invention also provides a system for preventing DHCP spoofing, comprising: a DHCP packet receiving module, a MAC address extraction module, a MAC address matching module, and a port reset module; wherein,

[0016] The DHCP packet receiving module is used to acquire DHCP packets and transmit the extracted DHCP packets to the MAC address extraction module;

[0017] The MAC address extraction module is used to extract the source MAC address based on the acquired DHCP data packet and transmit the extracted source MAC address to the MAC address matching module;

[0018] The MAC address matching module is used to match the source MAC address with the MAC address in the DHCP Snooping binding table;

[0019] The port reset module is used to set the uplink port corresponding to the source MAC address that has been successfully matched as a trusted port.

[0020] According to one embodiment of the system for preventing DHCP spoofing of the present invention, before the MAC address matching module performs address matching, it also determines whether the extracted source MAC address is included in the blacklist; if so, it is directly deleted; if not, source MAC address matching is performed.

[0021] According to one embodiment of the DHCP spoofing prevention system of the present invention, the DHCP spoofing prevention system establishes a DHCP Snooping binding table based on dynamic address allocation, and adds a list of trusted server IP addresses to the DHCP Snooping binding table, thereby matching the source MAC address of DHCP packets through the DHCP Snooping binding table.

[0022] According to one embodiment of the system for preventing DHCP spoofing of the present invention, when the MAC address matching module performs address matching, if the source MAC address does not match the MAC address in the DHCP Snooping binding table, the uplink port is set as an untrusted port, thereby intercepting and sniffing DHCP messages from the untrusted port and discarding abnormal DHCP response messages from the untrusted port.

[0023] The present invention also provides a computer-readable medium storing computer program code that, when executed by a processor, implements the method described above.

[0024] The present invention also provides an apparatus for preventing DHCP spoofing, comprising:

[0025] Memory, used to store instructions that can be executed by a processor; and

[0026] A processor for executing the instructions to implement the method described above.

[0027] Compared with existing technologies, this invention offers the following advantages: Addressing network chaos caused by DHCP servers, this invention employs DHCP Snooping technology to establish a DHCP Snooping binding table. This table matches the source MAC addresses corresponding to acquired DHCP packets, thereby setting successfully matched uplink ports as trusted ports and preventing DHCP spoofing. Therefore, this invention effectively prevents DHCP spoofing attacks, ensures network security, and avoids malicious damage to the network system's hardware, software, and data. Attached Figure Description

[0028] The above-described features and advantages of the present invention will be better understood after reading the following detailed description of embodiments of the present disclosure in conjunction with the accompanying drawings. In the drawings, components are not necessarily drawn to scale, and components having similar related characteristics or features may have the same or similar reference numerals.

[0029] Figure 1 This is a flowchart illustrating an embodiment of the method for preventing DHCP spoofing according to the present invention.

[0030] Figure 2 This is an architectural diagram illustrating an embodiment of the system for preventing DHCP spoofing according to the present invention. Detailed Implementation

[0031] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are merely some examples or embodiments of this application. For those skilled in the art, these drawings can be applied to other similar scenarios without creative effort. Unless obvious from the context or otherwise specified, the same reference numerals in the drawings represent the same structures or operations.

[0032] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0033] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of this application. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale. Techniques, methods, and devices known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and devices should be considered part of the specification. In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters in the following drawings denote similar items; therefore, once an item is defined in one drawing, it need not be further discussed in subsequent drawings.

[0034] In detailing the embodiments of the present invention, for ease of explanation, the cross-sectional views illustrating the device structure will be partially enlarged and not to scale. Furthermore, the schematic diagrams are merely examples and should not limit the scope of protection of the present invention. In actual fabrication, the three-dimensional spatial dimensions of length, width, and depth should be included.

[0035] In the description of this application, it should be understood that the orientation or positional relationship indicated by directional terms such as "front, back, up, down, left, right", "horizontal, vertical, horizontal" and "top, bottom" is usually based on the orientation or positional relationship shown in the accompanying drawings, and is only for the convenience of describing this application and simplifying the description. Unless otherwise stated, these directional terms do not indicate or imply that the device or element referred to must have a specific orientation or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on the scope of protection of this application; the directional terms "inner" and "outer" refer to the inner and outer contours relative to the outline of each component itself.

[0036] An embodiment of a method for preventing DHCP spoofing is disclosed herein. Figure 1 This is a flowchart illustrating an embodiment of the method for preventing DHCP spoofing according to the present invention. Please refer to... Figure 1 The following is a detailed explanation of each step in preventing DHCP spoofing.

[0037] Step S1: Obtain DHCP packets based on the controller, and extract the source MAC address based on the obtained DHCP packets.

[0038] Step S2: Determine if the source MAC address matches the MAC address in the DHCP Snooping binding table; if yes, set the uplink port as a trusted port; if no, proceed to the next step S3.

[0039] In this embodiment, before performing source MAC address matching, it is necessary to determine whether the extracted source MAC address is blacklisted. If so, the source MAC address is directly deleted. If not, source MAC address matching begins. During matching, a DHCP Snooping binding table is established based on dynamic address allocation, and a list of trusted server IP addresses is added to the DHCP Snooping binding table. This allows for the matching of source MAC addresses in DHCP packets using the DHCP Snooping binding table.

[0040] Specifically, DHCP Snooping is a DHCP security feature that filters untrusted DHCP messages by establishing and maintaining a DHCP Snooping binding table. This refers to DHCP messages originating from untrusted zones. The DHCP snooping function effectively prevents DHCP spoofing attacks. When this function is enabled, all user ports, unless specifically configured otherwise, are considered untrusted and should not respond to any DHCP messages. Therefore, fraudulent DHCP response packets are blocked by the switch, and legitimate DHCP server ports or uplink ports should be set as trusted ports.

[0041] DHCP snooping is also necessary to prevent ARP spoofing and IP / MAC address spoofing. By defining trusted and untrusted ports on the switch, DHCP messages on untrusted ports are intercepted and sniffed, and abnormal DHCP response messages from these ports are dropped, thereby avoiding DHCP spoofing attacks.

[0042] In operation, the switch can act as a small security firewall between the user and the DHCP server. It intercepts DHCP information within a virtual LAN and then uses its "DHCP snooping" function to build a DHCP binding table based on dynamic address allocation, storing this table within the switch. Thus, even in environments without DHCP (such as data centers), binding entries can be defined statically or dynamically. Each DHCP binding entry includes the client address (a static address or an address obtained from the DHCP server), the client MAC address, port, VLAN ID, lease time, and binding type (static or dynamic). The client address can be either a static address or an address obtained from the DHCP server.

[0043] Therefore, a DHCP Snooping binding table is established to add trusted server IP addresses. All user ports are considered untrusted and do not respond to any DHCP messages; thus, fraudulent DHCP response packets are blocked by the switch. Specifically, the switch determines whether the source address of the DHCP packets received belongs to a trusted server IP address. If the result is yes, the uplink port is set as a trusted port. If the result is no, the uplink port is set as an untrusted port. DHCP messages from untrusted ports are intercepted and sniffed, and abnormal DHCP response packets originating from untrusted ports are discarded.

[0044] Step S3: Delete the DHCP packet and increment the drop count of the source MAC address corresponding to the DHCP packet by 1.

[0045] Step S4: Determine if the number of times the source MAC address corresponding to the DHCP packet has been dropped is greater than N; if yes, add the source MAC address to the blacklist; if no, end the process.

[0046] In this embodiment, for DHCP packets with mismatched source MAC addresses, in addition to direct deletion, it is also necessary to mark the number of times the source MAC address has been dropped. When the number of marks accumulates to a preset maximum value N, the source MAC address is directly added to the blacklist and packets from that address are no longer accepted.

[0047] An embodiment of a system for preventing DHCP spoofing is also disclosed herein. Figure 2 This is an architectural diagram illustrating an embodiment of the system for preventing DHCP spoofing according to the present invention. Figure 2 As shown, in this embodiment, the system for preventing DHCP spoofing includes a DHCP packet receiving module, a MAC address extraction module, a MAC address matching module, and a port reset module. The DHCP packet receiving module acquires DHCP packets and transmits them to the MAC address extraction module. The MAC address extraction module extracts the source MAC address from the acquired DHCP packets and transmits it to the MAC address matching module. The MAC address matching module matches the source MAC address with MAC addresses in the DHCP Snooping binding table. The port reset module sets the uplink port corresponding to the successfully matched source MAC address as a trusted port.

[0048] Specifically, in this embodiment, before performing source MAC address matching, it is necessary to determine whether the extracted source MAC address is blacklisted. If so, the source MAC address is directly deleted. If not, source MAC address matching begins. During matching, a DHCP Snooping binding table is established based on dynamic address allocation, and a list of trusted server IP addresses is added to the DHCP Snooping binding table. This allows for matching the source MAC address of DHCP packets using the DHCP Snooping binding table. Specifically, DHCP Snooping technology is a DHCP security feature that filters untrusted DHCP information—specifically, DHCP information from untrusted zones—by establishing and maintaining the DHCP Snooping binding table. The DHCP snooping function effectively prevents DHCP spoofing attacks. When this function is enabled, all user ports, unless specifically configured, are considered untrusted and should not respond to any DHCP messages. Therefore, fraudulent DHCP response packets are blocked by the switch, and legitimate DHCP server ports or uplink ports should be set as trusted ports.

[0049] DHCP snooping is also necessary to prevent ARP spoofing and IP / MAC address spoofing. By defining trusted and untrusted ports on the switch, DHCP messages on untrusted ports are intercepted and sniffed, and abnormal DHCP response messages from these ports are dropped, thereby avoiding DHCP spoofing attacks.

[0050] In operation, the switch can act as a small security firewall between the user and the DHCP server. It intercepts DHCP information within a virtual LAN and then uses its "DHCP snooping" function to build a DHCP binding table based on dynamic address allocation, storing this table within the switch. Thus, even in environments without DHCP (such as data centers), binding entries can be defined statically or dynamically. Each DHCP binding entry includes the client address (a static address or an address obtained from the DHCP server), the client MAC address, port, VLAN ID, lease time, and binding type (static or dynamic). The client address can be either a static address or an address obtained from the DHCP server.

[0051] Therefore, a DHCP Snooping binding table is established to add trusted server IP addresses. All user ports are considered untrusted and do not respond to any DHCP messages; thus, fraudulent DHCP response packets are blocked by the switch. Specifically, the switch determines whether the source address of the DHCP packets received belongs to a trusted server IP address. If the result is yes, the uplink port is set as a trusted port. If the result is no, the uplink port is set as an untrusted port. DHCP messages from untrusted ports are intercepted and sniffed, and abnormal DHCP response packets originating from untrusted ports are discarded.

[0052] In addition, in this embodiment, for DHCP packets with mismatched source MAC addresses, in addition to direct deletion, it is also necessary to mark the number of times the source MAC address has been dropped. When the number of times the mark is accumulated reaches the preset maximum value N, the source MAC address is directly added to the blacklist and packets from that address are no longer accepted.

[0053] This specification also provides a computer-readable medium storing computer program code that, when executed by a processor, implements the method for preventing DHCP spoofing as described above.

[0054] This specification also provides a method for preventing DHCP spoofing, comprising storing an instruction memory executable by a processor, and a processor for executing the instructions in the instruction memory to implement the method for preventing DHCP spoofing as described above.

[0055] The prior description of this disclosure is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to this disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not intended to be limited to the examples and designs described herein, but should be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0056] Those skilled in the art will further appreciate that the various illustrative logic blocks, modules, circuits, and algorithm steps described in conjunction with the embodiments disclosed herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the various illustrative components, blocks, modules, circuits, and steps are described above in a generalized manner in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in different ways for each specific application, but such implementation decisions should not be construed as departing from the scope of the invention.

[0057] The various illustrative logic blocks, modules, and circuits described in conjunction with the embodiments disclosed herein can be implemented or performed using a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in alternatives, it may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration.

[0058] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of both. The software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor such that the processor can read and write information to / from the storage medium. In an alternative, the storage medium may be integrated into the processor. The processor and storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and storage medium may reside as discrete components in the user terminal.

[0059] In one or more exemplary embodiments, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functionality may be stored or transmitted as one or more instructions or code on or through a computer-readable medium. A computer-readable medium includes both computer storage media and communication media, encompassing any medium that facilitates the transfer of a computer program from one location to another. A storage medium may be any available medium accessible to a computer. By way of example and not limitation, such a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Any connection is also legitimately referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of a medium. As used in this article, disk and disc include compact discs (CDs), laser discs, optical discs, digital multi-purpose discs (DVDs), floppy disks, and Blu-ray discs. Disks typically reproduce data magnetically, while discs reproduce data optically using lasers. Combinations of these should also be included within the scope of computer-readable media.

Claims

1. A method for preventing DHCP spoofing, characterized in that, Includes the following steps: Step S1: Obtain DHCP packets based on the controller, and extract the source MAC address based on the obtained DHCP packets; Step S2: Determine if the source MAC address matches the MAC address in the DHCP Snooping binding table; if so, set the uplink port as a trusted port. If not, proceed to the next step S3; Step S3: Delete the DHCP packet and increment the drop count of the source MAC address corresponding to the DHCP packet by 1; Step S4: Determine whether the number of times the source MAC address corresponding to the DHCP packet has been dropped is greater than the preset maximum value N; if yes, add the source MAC address to the blacklist; if no, end the process.

2. The method for preventing DHCP spoofing according to claim 1, characterized in that, Before performing source MAC address matching, the method for preventing DHCP spoofing also determines whether the extracted source MAC address is blacklisted; if so, it is deleted directly; otherwise, source MAC address matching is performed.

3. The method for preventing DHCP spoofing according to claim 2, characterized in that, The method for preventing DHCP spoofing establishes a DHCP Snooping binding table based on dynamic address allocation and adds a list of trusted server IP addresses to the DHCP Snooping binding table, thereby matching the source MAC address of DHCP packets through the DHCP Snooping binding table.

4. The method for preventing DHCP spoofing according to claim 1, characterized in that, In step S2, if the source MAC address does not match the MAC address in the DHCP Snooping binding table, the uplink port is set as an untrusted port, thereby intercepting and sniffing DHCP messages from the untrusted port and discarding abnormal DHCP response messages from the untrusted port.

5. A system for preventing DHCP spoofing, characterized in that, include: The system includes a DHCP packet receiving module, a MAC address extraction module, a MAC address matching module, and a port reset module; among which, The DHCP packet receiving module is used to acquire DHCP packets and transmit the extracted DHCP packets to the MAC address extraction module; The MAC address extraction module is used to extract the source MAC address based on the acquired DHCP data packet and transmit the extracted source MAC address to the MAC address matching module; The MAC address matching module is used to match the source MAC address with the MAC address in the DHCP Snooping binding table; The port reset module is used to set the uplink port corresponding to the source MAC address that has been successfully matched as a trusted port.

6. The system for preventing DHCP spoofing according to claim 5, characterized in that, Before performing address matching, the MAC address matching module also determines whether the extracted source MAC address is blacklisted; if so, it is deleted directly; otherwise, source MAC address matching is performed.

7. The system for preventing DHCP spoofing according to claim 6, characterized in that, The system for preventing DHCP spoofing establishes a DHCP Snooping binding table based on dynamic address allocation and adds a list of trusted server IP addresses to the DHCP Snooping binding table, thereby matching the source MAC address of DHCP packets through the DHCP Snooping binding table.

8. The system for preventing DHCP spoofing according to claim 5, characterized in that, When the MAC address matching module performs address matching, if the source MAC address does not match the MAC address in the DHCP Snooping binding table, it sets the uplink port to an untrusted port, thereby intercepting and sniffing DHCP messages from the untrusted port and discarding abnormal DHCP response messages from the untrusted port.

9. A computer-readable medium storing computer program code, characterized in that, The computer program code, when executed by a processor, implements the method as described in any one of claims 1-4.

10. A device for preventing DHCP spoofing, characterized in that, include: Memory is used to store instructions that can be executed by the processor; as well as A processor for executing the instructions to implement the method as described in any one of claims 1-4.

Images