Hci managed arp

Abstract

An information handling system can include a memory and at least one processor. The information handling system can be configured to: maintain a repository of address resolution protocol (ARP) records for a plurality of information handling systems; and in response to a request from one of the plurality of information handling systems to update a record in the repository: validate the request; update the record; and distribute the updated record to at least some of the plurality of information handling systems.

Description

Technical Field

[0001] This disclosure generally relates to information processing systems, and more specifically to techniques for managing the Address Resolution Protocol (ARP) and preventing spoofing. Background Technology

[0002] As the value and use of information continue to grow, individuals and businesses are seeking additional ways to process and store information. One option available to users is an information processing system. Information processing systems typically process, compile, store, and / or transmit information or data for business, personal, or other purposes, thereby allowing users to leverage the value of this information. Because technology and information processing needs vary across different users or applications, information processing systems may also differ in terms of: what information is processed, how it is processed, how much information is processed, stored, or transmitted, and how quickly and efficiently it can be processed, stored, or transmitted. Variations in information processing systems allow them to be general-purpose or configured for specific users or purposes (such as financial transaction processing, airline ticketing, enterprise data storage, or global communications). Furthermore, information processing systems can include a variety of hardware and software components that can be configured to process, store, and transmit information, and may include one or more computer systems, data storage systems, and networking systems.

[0003] Hyperconverged infrastructure (HCI) is an IT framework that combines storage, compute, and networking into a single system in an attempt to reduce data center complexity and improve scalability. A hyperconverged platform may include hypervisors for virtualized compute, software-defined storage, and virtualized networking, and these typically run on standard off-the-shelf servers. One type of HCI solution is Dell EMC VxRail. TM Systems. Some examples of HCI systems can be found in various environments (e.g., such as...). ESXi TM It runs in an HCI management system (such as an environment or any other HCI management system).

[0004] In the context of HCI (and other contexts), information processing systems may execute virtual machines (VMs) for various purposes. A VM generally includes any program or set of executable instructions configured to run a guest operating system on a hypervisor or host operating system. This allows the hypervisor / host operating system to manage and / or control the allocation and use of hardware resources such as memory, central processing unit time, disk space, and input / output devices, and to provide an interface between these hardware resources and applications hosted by the guest operating system.

[0005] In the context of HCI (and others), ARP is a communication protocol used to discover link-layer addresses (e.g., Media Access Control (MAC) addresses) associated with a given Internet Layer address (e.g., an IP address). Incorrect ARP records pose a threat to network security and stability. They are often caused by accidental Internet Protocol (IP) address conflicts and / or intentionally by attackers (known as ARP spoofing).

[0006] In an HCI system, nodes may frequently enter and leave the cluster, resulting in a large number of dynamic IP address changes. This can increase the risk of ARP problems.

[0007] Therefore, embodiments of this disclosure can provide techniques for automatically avoiding ARP spoofing, which can leverage a centralized source of truth to provide protection for the entire system or data center. For the sake of specificity, an example of an HCI cluster will be discussed in detail; however, those skilled in the art who benefit from this disclosure will understand its applicability to other systems.

[0008] It should be noted that the technical discussions in the background section of this disclosure do not constitute an admission of the state of the prior art. Unless expressly and unambiguously indicated otherwise, no such admission is made herein. Summary of the Invention

[0009] Based on the teachings of this disclosure, the drawbacks and problems associated with ARP spoofing can be reduced or eliminated.

[0010] According to embodiments of this disclosure, an information processing system may include a memory and at least one processor. The information processing system may be configured to: maintain a repository of Address Resolution Protocol (ARP) records for a plurality of information processing systems; and, in response to a request from one of the plurality of information processing systems to update a record in the repository: verify the request; update the record; and distribute the updated record to at least some of the plurality of information processing systems.

[0011] According to these and other embodiments of this disclosure, a computer-implemented method may include: an information processing system maintaining a repository of Address Resolution Protocol (ARP) records for a plurality of information processing systems; and in response to a request from one of the plurality of information processing systems to update a record in the repository, the information processing system: verifies the request; updates the record; and distributes the updated record to at least some of the plurality of information processing systems.

[0012] According to these and other embodiments of this disclosure, an article of manufacture may include a non-transitory computer-readable medium having computer-executable instructions that can be executed by a processor of an information processing system to: maintain a repository of Address Resolution Protocol (ARP) records of a plurality of information processing systems; and in response to a request from one of the plurality of information processing systems to update a record in the repository: verify the request; update the record; and distribute the updated record to at least some of the plurality of information processing systems.

[0013] The technical advantages of this disclosure will be readily understood by those skilled in the art based on the accompanying drawings, description, and claims included herein. The objectives and advantages of the embodiments will be realized and achieved, at least by the elements, features, and combinations specifically pointed out in the claims.

[0014] It should be understood that the foregoing general description and the following detailed description are exemplary and not intended to limit the claims set forth in this disclosure. Attached Figure Description

[0015] This embodiment and its advantages can be more fully understood by referring to the following description taken in conjunction with the accompanying drawings, wherein the same reference numerals indicate the same features, and wherein:

[0016] Figure 1 A block diagram of an exemplary information processing system according to an embodiment of the present disclosure is shown;

[0017] Figure 2 An exemplary process flow for adding a new host to a cluster is shown according to an embodiment of this disclosure;

[0018] Figure 3 An exemplary process flow for a host leaving a cluster is illustrated according to an embodiment of this disclosure; and

[0019] Figure 4 An exemplary process flow for replacing or reconfiguring a network interface card for a host, according to an embodiment of this disclosure, is shown. Detailed Implementation

[0020] By reference Figures 1 to 4 To best understand the preferred embodiments and their advantages, the same numbering is used to indicate the same and corresponding parts.

[0021] For the purposes of this disclosure, the term "information processing system" can include any tool or set of tools operable to calculate, classify, process, transmit, receive, retrieve, generate, switch, store, display, indicate, detect, record, reproduce, dispose of, or utilize information, intelligence, or data of any form for commercial, scientific, control, entertainment, or other purposes. For example, an information processing system can be a personal computer, a personal digital assistant (PDA), a consumer electronic device, a network storage device, or any other suitable device, and can vary in size, shape, performance, functionality, and price. An information processing system can include memory, one or more processing resources, such as a central processing unit ("CPU"), or hardware or software control logic. Additional components of an information processing system can include one or more storage devices, one or more communication ports for communicating with external devices, and various input / output ("I / O") devices, such as a keyboard, mouse, and video display. An information processing system may also include one or more buses operable to transmit communication between various hardware components.

[0022] For the purposes of this disclosure, when two or more elements are referred to as being “coupled” to each other, such terminology indicates that such two or more elements are in electronic communication or mechanical connection, whether indirect or direct, with or without an intermediate element, as applicable.

[0023] When two or more elements are referred to as “coupleable” to each other, such a term indicates that they are able to couple together.

[0024] For the purposes of this disclosure, the term "computer-readable medium" (e.g., temporary or non-temporary computer-readable medium) can include any tool or set of tools that can retain data and / or instructions for a period of time. Computer-readable media can include, but is not limited to: storage media such as direct access storage devices (e.g., hard disk drives or floppy disks), sequential access storage devices (e.g., magnetic tape drives), optical discs, CD-ROMs, DVDs, random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and / or flash memory; communication media such as wires, optical fibers, microwaves, radio waves, and other electromagnetic and / or optical carrier waves; and / or any combination of the foregoing.

[0025] For the purposes of this disclosure, the term "information processing resource" may be used broadly to refer to any component system, apparatus or device of an information processing system, including but not limited to processors, service processors, basic input / output systems, buses, memory, I / O devices and / or interfaces, storage resources, network interfaces, motherboards and / or any other components and / or elements of the information processing system.

[0026] For the purposes of this disclosure, the term "management controller" may be used broadly to refer to an information processing system that provides management functionality (typically out-of-band management functionality) to one or more other information processing systems. In some embodiments, the management controller may be a service processor, a baseboard management controller (BMC), a chassis management controller (CMC), or a remote access controller (e.g., a Dell Remote Access Controller (DRAC) or an integrated Dell Remote Access Controller (iDRAC)) (or may be a component thereof).

[0027] Figure 1 A block diagram of an exemplary information processing system 102 according to embodiments of the present disclosure is shown. In some embodiments, the information processing system 102 may include a server chassis configured to house multiple servers or "blades". In other embodiments, the information processing system 102 may include a personal computer (e.g., a desktop computer, laptop computer, mobile computer, and / or notebook computer). In still other embodiments, the information processing system 102 may include a storage enclosure configured to house multiple physical disk drives and / or other computer-readable media for storing data (which may generally be referred to as "physical storage resources"). Figure 1 As shown, the information processing system 102 may include a processor 103, a memory 104 communicatively coupled to the processor 103, a BIOS 105 (e.g., UEFI BIOS) communicatively coupled to the processor 103, a network interface 108 communicatively coupled to the processor 103, and a management controller 112 communicatively coupled to the processor 103.

[0028] In operation, processor 103, memory 104, BIOS 105, and network interface 108 may include at least a portion of the host system 98 of information processing system 102. In addition to the elements explicitly shown and described, information processing system 102 may include one or more other information processing resources.

[0029] Processor 103 may include any system, apparatus, or device configured to interpret and / or execute program instructions and / or process data, and may include, but is not limited to, microprocessors, microcontrollers, digital signal processors (DSPs), application-specific integrated circuits (ASICs), or any other digital or analog circuit configured to interpret and / or execute program instructions and / or process data. In some embodiments, processor 103 may interpret and / or execute program instructions and / or process data stored in memory 104 and / or another component of information processing system 102.

[0030] Memory 104 may be communicatively coupled to processor 103 and may include any system, apparatus, or device (e.g., computer-readable medium) configured to retain program instructions and / or data for a period of time. Memory 104 may include any suitable selection and / or array of RAM, EEPROM, PCMCIA card, flash memory, magnetic storage device, optical-magnetic storage device, or volatile memory or non-volatile memory that retains data after power failure of information processing system 102.

[0031] like Figure 1 As shown, an operating system 106 may be stored on memory 104. Operating system 106 may include any executable program (or set of executable programs) configured to manage and / or control the allocation and use of hardware resources such as memory, processor time, disk space, and input and output devices, and to provide an interface between such hardware resources and applications hosted by operating system 106. Additionally, operating system 106 may include all or part of a network stack for network communication via a network interface (e.g., network interface 108 for communication over a data network). Although operating system 106... Figure 1 The operating system 106 is shown as being stored in memory 104, but in some embodiments, the operating system 106 may be stored in a storage medium accessible to the processor 103, and the active portion of the operating system 106 may be transferred from such storage medium to memory 104 for execution by the processor 103.

[0032] Network interface 108 may include one or more suitable systems, devices, or apparatuses operable to act as an interface between information processing system 102 and one or more other information processing systems via an in-band network. Network interface 108 may enable information processing system 102 to communicate using any suitable transport protocol and / or standard. In these and other embodiments, network interface 108 may include a network interface card or “NIC”. In these and other embodiments, network interface 108 may be enabled as an onboard local area network (LAN) (LOM) card.

[0033] Management controller 112 can be configured to provide management functionality to the information processing system 102. This management can be performed by management controller 112 even when the information processing system 102 and / or host system 98 are powered off or powered to a standby state. Management controller 112 may include processor 113, memory, and a network interface 118 that is separate from and physically isolated from network interface 108.

[0034] like Figure 1As shown, the processor 113 of the management controller 112 can be communicatively coupled to the processor 103. This coupling can be made via a Universal Serial Bus (USB), a System Management Bus (SMBus), and / or one or more other communication channels.

[0035] Network interface 118 can be coupled to a management network, as shown, which can be decoupled from and physically isolated from the data network. Network interface 118 of management controller 112 can include any suitable system, device, or apparatus operable to act as an interface between management controller 112 and one or more other information processing systems via an out-of-band management network. Network interface 118 enables management controller 112 to communicate using any suitable transport protocol and / or standard. In these and other embodiments, network interface 118 can include a network interface card or "NIC". Network interface 118 can be a device of the same type as network interface 108, or in other embodiments it can be a different type of device.

[0036] As discussed above, embodiments of this disclosure can provide protection against erroneous ARP records, such as those resulting from ARP spoofing attacks. One embodiment utilizes a central control point as a single trusted source of fact. For example, an HCI management system (e.g., a management VM executing cluster nodes) can be designated as the central control point. Generally, the term "central control point" is used herein to refer to any system reachable by other hosts and considered a source of fact for ARP data. The central control point can collect valid ARP records and distribute them to all available hosts in the cluster. In some embodiments, the central control point and other hosts may have a pre-existing trusted and / or encrypted communication channel that allows them to securely transmit ARP information.

[0037] Hosts in the cluster can use application programming interfaces (APIs) (such as REST APIs) provided by the central control point to register, deregister, and / or update the NIC adapter IP addresses and media access control (MAC) address information of other hosts, and then create and / or update local static ARP records. This capability can be particularly useful in scenarios that might arise in an HCI cluster context, as discussed below. For example, when a new host joins the cluster, its ARP record needs to be assigned to the rest of the cluster. (And since the initialization of a new cluster can be considered as the addition of multiple new hosts, this implementation also applies to cluster initialization.) When a host leaves the cluster, its ARP record needs to be deleted from the rest of the cluster. When a host replaces or reconfigures its network adapter, the updated ARP record needs to be assigned to the rest of the cluster.

[0038] The implementation can utilize a first component that executes at a central control point and a second component that executes on each host in the cluster. The first and second components can each be implemented as hardware, software, and / or firmware. For example, in one implementation, they can be implemented to execute within a VM on the respective host.

[0039] The central control point component can provide a data collector service that collects Layer 3 interface ARP information from all hosts in the cluster (including information for the central control point itself) and stores this information in an ARP repository. This service allows hosts to register their L3 interface ARP records and provides interfaces for requesting hosts to join, leave, or modify their ARP information. The central control point component can also provide ARP bundle datasets containing necessary information to record and identify the host network configuration of the cluster. This may include information such as cluster ID, host ID, L3 interface IP address, NIC adapter MAC address, and, in the case of VLANs, Virtual LAN (VLAN) ID.

[0040] The central control point component may also include a data distributor service. Whenever there are any changes to the data stored by the data collector service, the data distributor service can push these changes to each node. For example, updates can be based on data snapshots, differential updates, etc.

[0041] The host component that runs on each host in the cluster may include a host ARP sink. The host ARP sink can act as a data sink, providing a REST API service to the central control point for invocation to push ARP content across the cluster. The host component may also include a data updater, which updates the local ARP entry table based on data received from the central control point.

[0042] Turn now Figure 2 An exemplary method 200 is shown for ARP management tasks that may occur when a new host joins the cluster. At step 201, the new host may send ARP bundle information to the central control point to trigger the process for joining the new host to the cluster.

[0043] At step 202, the central control point can update its records accordingly. If the ARP bundle is valid (e.g., no conflicts), the central control point's ARP repository can be updated. If the ARP bundle is invalid, the central control point may not take further action. In modern hypervisors and operating systems, it is common for static ARP entries to have a higher priority than dynamic ARP entries. Therefore, valid new host registration can occur without causing problems because the new IP does not have a static ARP entry.

[0044] At step 203 (assuming the ARP bundle is valid), the central control point can trigger the allocation to each host (including itself). At step 204, the central control point can allocate records by sending update information to each host.

[0045] At step 205, a host can trigger an update. After receiving the allocation from the central control point in step 204, each host can apply the new data via the data updater component. At step 206, each host can perform a configuration task to apply the changes to its own ARP entries. After step 206, the method can terminate.

[0046] Turn now Figure 3 An exemplary method 300 is shown for ARP management tasks that may occur when a host leaves the cluster. At step 301, the host leaving the cluster may send a request to the central control point to trigger a process for removing the host.

[0047] At step 302, the central control point can update its records accordingly. If the request is valid (e.g., an ARP record corresponding to the removal request exists), the central control point's ARP repository can be updated. If the request is invalid, the central control point may not take further action. Because static ARP records have higher priority than dynamic ARP records, communication between the central control point and the cluster's hosts will remain normal.

[0048] At step 303 (assuming the request is valid), the central control point can trigger the allocation to each host (including itself). At step 304, the central control point can allocate records by sending update information to each host.

[0049] At step 305, a host can trigger the deletion of a specified ARP entry for the host that is leaving the cluster. At step 306, each host can perform a configuration task to apply the deletion to its own ARP entries.

[0050] At step 307, a host leaving the cluster can trigger the cleanup of its local ARP entries. At step 308, a host leaving the cluster can perform a configuration task to clean up its local ARP table (e.g., by resetting it to its default state). After step 308, the method can end.

[0051] Turn now Figure 4An exemplary method 400 is shown for ARP management tasks that may occur when a host replaces (or reconfigures) a NIC. At step 401, the host may send a change request (e.g., including an old ARP bundle and a new ARP bundle to replace the old ARP bundle) to a central control point to trigger a process for updating ARP information.

[0052] At step 402, the central control point can update its records accordingly. If the request is valid (e.g., the old ARP bundle exists while the new ARP bundle does not), the central control point's ARP repository can be updated. If the request is invalid, the central control point may not take further action. Because static ARP records have higher priority than dynamic ARP records, communication between the central control point and the cluster's hosts will remain normal.

[0053] At step 403 (assuming the request is valid), the central control point can trigger the allocation to each host (including itself). At step 404, the central control point can allocate records by sending update information to each host.

[0054] At step 405, a host can trigger an update. After receiving the allocation from the central control point in step 404, each host can apply the new data via the data updater component. At step 406, each host can perform a configuration task to apply the changes to its own ARP entries. After step 406, the method can terminate.

[0055] Those skilled in the art who benefit from this disclosure will understand that, for Figures 2 to 4 The preferred initialization points and the order of steps constituting those methods described can depend on the chosen implementation. In these and other embodiments, the methods can be implemented as hardware, firmware, software, applications, functions, libraries, or other instructions. Furthermore, although... Figures 2 to 4 The disclosure specifies a particular number of steps to be taken in the disclosed method, but the method can be performed with more or fewer steps than depicted. The method may utilize various components disclosed herein (such as...). Figure 1 The method can be implemented by any one of the components and / or any other system operable to implement the method.

[0056] This disclosure covers all changes, substitutions, variations, alterations, and modifications of the exemplary embodiments herein that will be understood by those skilled in the art. Similarly, where appropriate, the appended claims cover all changes, substitutions, variations, alterations, and modifications of the exemplary embodiments herein that will be understood by those skilled in the art. Furthermore, references in the appended claims to a device, system, or component adapted to, arranged to, capable of, configured to, enabled to, operable to, or operationally perform a particular function include said device, system, or component, whether or not said device, system, or component or said particular function is activated, turned on, or unlocked, provided that said device, system, or component is adapted to, arranged to, capable of, configured to, enabled to, operable to, or operationally performs the particular function.

[0057] Furthermore, the description in the appended claims that the structure is “configured” or “operable to” perform one or more tasks is expressly intended not to invoke 35 U.S.SC §112(f) for the claimed elements. Therefore, none of the claims submitted in this application are intended to be construed as having additional functional elements of a device. If the applicant wishes to invoke §112(f) during the period of suit, the applicant will use the structure “device for [performing a function]” to describe the claimed elements.

[0058] All examples and conditional language described herein are intended to aid the reader in understanding the invention and to teach concepts contributed by the inventors to advance the field, and should be construed as not being limited to such specific examples and conditions. Although embodiments of the invention have been described in detail, it should be understood that various changes, substitutions, and modifications can be made therein without departing from the spirit and scope of this disclosure.

Claims

1. An information processing system, comprising: At least one processor; as well as Memory; The information processing system is configured as follows: Maintain a repository for Address Resolution Protocol (ARP) records of multiple information processing systems, which are nodes of a hyperconverged infrastructure (HCI) cluster; as well as In response to at least one request from one of the plurality of information processing systems to update the ARP records in the repository with new ARP information: The at least one request is verified by determining whether the new ARP information conflicts with any other ARP record in the repository; Update the ARP record; and The updated ARP record is assigned to at least some of the information processing systems by calling the application programming interface (API) of at least some of the information processing systems. The at least one request for updating the ARP record includes: a request to create a new ARP record for a new node being added to the HCI cluster.

2. The information processing system according to claim 1, wherein the repository is maintained by a virtual machine running on a specific node of the HCI cluster.

3. The information processing system according to claim 1, wherein the at least one request for updating the ARP record includes: Requests to delete existing ARP records for nodes that are being removed from the HCI cluster.

4. The information processing system according to claim 1, wherein the at least one request for updating the ARP record includes: Requests to modify existing ARP records of nodes in the HCI cluster that have undergone changes related to the network interface adapter.

5. A computer-implemented method, comprising: The information processing system maintains a repository of Address Resolution Protocol (ARP) records for multiple information processing systems, which are nodes of a hyperconverged infrastructure cluster. as well as In response to at least one request from one of the plurality of information processing systems to update ARP records in the repository with new ARP information, the information processing system: The at least one request is verified by determining whether the new ARP information conflicts with any other ARP record in the repository; Update the ARP record; and The updated ARP record is assigned to at least some of the multiple information processing systems by calling the application programming interface (API) of at least some of the multiple information processing systems. The at least one request for updating the ARP record includes: a request to create a new ARP record for a new node being added to the HCI cluster.

6. The method of claim 5, wherein the repository is maintained by a virtual machine running on a specific node of the HCI cluster.

7. The method of claim 5, wherein the at least one request to update the ARP record comprises: Requests to delete existing ARP records for nodes that are being removed from the HCI cluster.

8. The method of claim 5, wherein the at least one request to update the ARP record comprises: A request to modify existing ARP records of nodes in the HCI cluster that have undergone changes related to the network interface adapter.

9. An article of manufacture comprising a non-transitory computer-readable medium having computer-executable instructions thereon, the computer-executable instructions being executable by a processor of an information processing system to: Maintain a repository for Address Resolution Protocol (ARP) records of multiple information processing systems, which are nodes of a hyperconverged infrastructure (HCI) cluster; as well as In response to at least one request from one of the plurality of information processing systems to update the ARP records in the repository with new ARP information: The at least one request is verified by determining whether the new ARP information conflicts with any other ARP record in the repository; Update the ARP record; and The updated ARP record is assigned to at least some of the information processing systems by calling the application programming interface (API) of at least some of the information processing systems. The at least one request for updating the ARP record includes: a request to create a new ARP record for a new node being added to the HCI cluster.

10. The article of claim 9, wherein the repository is maintained by a virtual machine running on a specific node of the HCI cluster.

11. The article of manufacture of claim 9, wherein the at least one request for updating the ARP record comprises: Requests to delete existing ARP records for nodes that are being removed from the HCI cluster.

12. The article of manufacture of claim 9, wherein the at least one request for updating the ARP record comprises: Requests to modify existing ARP records of nodes in the HCI cluster that have undergone changes related to the network interface adapter.

Images