Network device based on ARP anti-spoofing

Abstract

The application provides a network device based on ARP anti-spoofing. The network device is used for accessing a local area network and comprises a gateway, at least one switch and at least one terminal device. A controller is configured to perform the following steps: S1: setting a first key and a second key in the gateway, the gateway sharing the first key with the at least one switch, and the gateway sharing the second key with the at least one terminal device; S2: establishing a mutual trust relationship between the gateway and the at least one switch by using the first key; S3: negotiating a temporary key between the gateway and the at least one switch based on the mutual trust relationship; S4: receiving, by the at least one switch, a first ARP request message claimed to be from the gateway, judging, by the at least one switch, whether the first ARP request message is an ARP spoofing attack based on the temporary key, and performing step S5 if the judgment is yes; and S5: blocking an access interface and generating a warning if the access interface receives the first ARP request message.

Description

Technical Field

[0001] This application mainly relates to the field of network security, and in particular to a network device based on ARP anti-spoofing. Background Technology

[0002] In an architecture where multiple network devices access the network using static IP (Internet Protocol) addresses, communication between these devices relies on the Address Resolution Protocol (ARP) to translate IP addresses into MAC (Media Access Control) addresses. The basic operation of ARP is as follows: devices broadcast ARP request messages before communication, the target device responds with its MAC address, and the requesting device caches the response for subsequent communication. Because this protocol lacks state management, authentication, and trust constraint mechanisms in its design, its "trust"-based communication model leads to devices unconditionally accepting and responding to ARP messages, creating a security vulnerability for ARP spoofing attacks. An ARP spoofing attack refers to an attacker forging ARP response messages, mapping a legitimate IP address (such as a gateway IP) to their own MAC address, causing other devices in the network to mistakenly send traffic to the attacker, thereby achieving malicious actions such as man-in-the-middle attacks, data eavesdropping, or network disruption. This makes preventing ARP spoofing extremely difficult in a static IP environment.

[0003] To address this issue, existing solutions include static ARP binding, dynamic ARP detection, and gateway-side ARP protection. Static ARP binding requires manual maintenance of the IP-MAC mapping table, resulting in high management costs and an inability to handle MAC address changes. Dynamic ARP detection relies on DHCP (Dynamic Host Configuration Protocol) snooping, which is unusable in static IP environments. Gateway-side ARP spoofing attack protection only drops suspicious ARP packets at the gateway level and cannot block the spoofing source port.

[0004] Therefore, there is an urgent need for a network device suitable for static IP networks that can automatically identify legitimate devices and accurately isolate ARP spoofing attacks. Summary of the Invention

[0005] Based on the above problems, this application proposes a network device based on ARP anti-spoofing, which can reduce the risk of ARP spoofing attacks in static IP networks.

[0006] This application proposes a network device based on ARP anti-spoofing. The network device is used to access a local area network and includes: the network device includes a gateway, at least one switch, and at least one terminal device; a controller configured to perform the following steps: S1: setting a first key and a second key in the gateway, the gateway sharing the first key with the at least one switch, and the gateway sharing the second key with the at least one terminal device; S2: establishing a mutual trust relationship between the gateway and the at least one switch using the first key; S3: negotiating a temporary key between the gateway and the at least one switch based on the mutual trust relationship; S4: the at least one switch receives a first ARP request packet claiming to be from the gateway, and the at least one switch determines whether the first ARP request packet is an ARP spoofing attack based on the temporary key. If the determination is yes, then step S5 is executed; S5: if the interface through which the at least one switch receives the first ARP request packet is an access interface, then the access interface is blocked and a warning is generated.

[0007] Compared with existing technologies, the advantages of this application are as follows: This application implements the authentication process between network devices through pre-configured first and second keys, enabling network device identification and authentication without the need for DHCP protocol involvement. Furthermore, it combines unified identity mutual trust authentication on the gateway side with ARP spoofing attack identification and blocking mechanisms on the switch and terminal device sides to effectively combat ARP spoofing attacks. Attached Figure Description

[0008] The accompanying drawings are included to provide a further understanding of this application; they are incorporated into and constitute a part of this application. The drawings illustrate embodiments of this application and, together with this specification, serve to explain the principles of this application. In the drawings: Figure 1 This is a schematic flowchart illustrating the method for configuring the controller of a network device based on ARP anti-spoofing, as provided in an embodiment of this application. Figure 2 This is a schematic diagram of the method for establishing mutual trust between the gateway and the switch of the controller of the network device based on ARP anti-spoofing provided in this application embodiment; Figure 3 This is a schematic diagram illustrating the specific method for establishing mutual trust between the gateway and the switch configured in the controller of the network device based on ARP anti-spoofing provided in this application embodiment; Figure 4 This is a flowchart illustrating the method for determining the interface type of the controller of a network device based on ARP anti-spoofing, as provided in an embodiment of this application. Figure 5 This is a schematic diagram of the structure of a network device based on ARP anti-spoofing provided in an embodiment of this application; Figure 6 This is a schematic flowchart illustrating the method for configuring the controller of a network device based on ARP anti-spoofing to identify ARP spoofing attacks, as provided in an embodiment of this application. Figure 7 This is a schematic diagram of the method for establishing a mutual trust relationship between the controller of the network device based on ARP anti-spoofing and the target network device, provided in an embodiment of this application.

[0009] Reference numerals: Gateway 110, Gateway Interface 111, First Switch 120, Second Switch 130, Gateway Interface 111, First Interface 121 of First Switch, Second Interface 122 of First Switch, First Interface 131 of Second Switch, Second Interface 132 of Second Switch. Detailed Implementation

[0010] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are merely some examples or embodiments of this application. For those skilled in the art, these drawings can be applied to other similar scenarios without creative effort. Unless obvious from the context or otherwise specified, the same reference numerals in the drawings represent the same structures or operations.

[0011] As indicated in this application, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" do not specifically refer to the singular and may also include the plural. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0012] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of this application. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale. Techniques, methods, and devices known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and devices should be considered part of the specification. In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters in the following drawings denote similar items; therefore, once an item is defined in one drawing, it need not be further discussed in subsequent drawings.

[0013] In the description of this application, it should be understood that the orientation or positional relationship indicated by directional terms such as "front, back, up, down, left, right", "horizontal, vertical, horizontal" and "top, bottom" is usually based on the orientation or positional relationship shown in the accompanying drawings, and is only for the convenience of describing this application and simplifying the description. Unless otherwise stated, these directional terms do not indicate or imply that the device or element referred to must have a specific orientation or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on the scope of protection of this application; the directional terms "inner" and "outer" refer to the inner and outer contours relative to the outline of each component itself.

[0014] For ease of description, spatial relative terms such as "above," "on top of," "on the upper surface of," "above," etc., are used herein to describe the spatial positional relationship of a device or feature as shown in the figures to other devices or features. It should be understood that spatial relative terms are intended to encompass different orientations in use or operation beyond the orientation of the device as described in the figures. For example, if the device in the figures were inverted, a device described as "above" or "on top of" other devices or structures would subsequently be positioned as "below" or "under" other devices or structures. Thus, the exemplary term "above" can include both "above" and "below." The device may also be positioned in other different ways (rotated 90 degrees or in other orientations), and the spatial relative descriptions used herein will be interpreted accordingly.

[0015] Furthermore, it should be noted that the use of terms such as "first" and "second" to define components is merely for the purpose of distinguishing the corresponding components. Unless otherwise stated, these terms have no special meaning and therefore should not be construed as limiting the scope of protection of this application. In addition, although the terminology used in this application is selected from commonly known and used terms, some terms mentioned in this application's specification may have been chosen by the applicant according to his or her judgment, and their detailed meanings are explained in the relevant sections of this description. Moreover, this application should be understood not only through the actual terms used, but also through the meaning implied by each term.

[0016] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more steps may be removed from these processes.

[0017] The following describes the ARP anti-spoofing network device (hereinafter referred to as "network device") based on this application through specific embodiments.

[0018] Network devices are connected to a local area network (LAN). These devices are pre-configured with fixed IP addresses, subnet masks, and default gateways, rather than dynamically obtaining IP addresses through a DHCP server. The network devices include a gateway, at least one switch, and at least one terminal device.

[0019] In some embodiments, the network device may include only one switch, which can act as both a gateway and a switch.

[0020] refer to Figure 1 The network device also includes a controller, which is configured to perform actions such as Figure 1 Steps S1 to S5 in the process.

[0021] In step S1, a first key and a second key are set in the gateway. The gateway shares the first key with at least one switch and the second key with at least one terminal device.

[0022] The gateway pre-configures a first key in each of at least one switch and a second key in each of at least one terminal device.

[0023] In step S2, a mutual trust relationship is established between the gateway and at least one switch using the first key.

[0024] Specifically, the gateway and at least one switch perform two-way authentication using a first key, and a mutual trust relationship is established after successful authentication.

[0025] In some embodiments, reference Figure 2 Step S2 includes Figure 2 Steps S21 to S23 in the process.

[0026] In step S21, if the gateway is configured with an IP list of at least one switch, then step S22 is executed.

[0027] Specifically, the gateway is configured with an IP list corresponding to at least one switch. This IP list is pre-configured on the gateway by the network administrator and records the IP address information of switches allowed to establish communication connections with the gateway. When the gateway connects to the local area network and completes initialization, it reads its local configuration and determines whether the IP list exists. If it does, meaning the gateway has configured an IP list for at least one switch, step S22 is executed. At this point, the gateway sends challenge messages to each switch via unicast based on the IP addresses in the IP list, initiating the process of establishing mutual trust.

[0028] In step S22, at least one switch includes a first target switch. The gateway sends a first challenge message to the first target switch. If the first challenge message is successful, the first target switch and the gateway establish a mutual trust relationship.

[0029] Specifically, each of at least one switch can be the first target switch, and the gateway challenges the first target switch using unicast, that is, it only authenticates one switch at a time.

[0030] In some embodiments, reference Figure 3 Step S22 includes Figure 3 Steps S22a to S22d in the process.

[0031] In step S22a, the gateway sends a first challenge message to the first target switch. The first challenge message includes a first random character.

[0032] Specifically, the first challenge message contains a first random character, which is a string of random numbers or letters temporarily generated by the gateway when sending the first challenge message, to ensure the independence and unpredictability of each challenge process.

[0033] In step S22b, after receiving the first challenge message, the first target switch encrypts the first random character using the first key to form an encrypted first random character. The first target switch then sends the encrypted first random character and the second random character to the gateway.

[0034] Specifically, after receiving the first challenge message, the first target switch first extracts the first random character from the first challenge message and temporarily generates a second random character; then, the first target switch uses the first key stored locally to generate an encrypted first random character and sends the encrypted first random character and the second random character to the gateway.

[0035] In step S22c, the gateway uses the first key to decrypt the encrypted first random character and obtains the first decryption result. If the first decryption result is the first random character, the gateway uses the first key to encrypt the second random character to form the encrypted second random character. The gateway then sends the encrypted second random character to the first target switch.

[0036] Specifically, after receiving the encrypted first random character and the second random character, the gateway first uses the locally stored first key to decrypt the encrypted first random character, obtaining a first decryption result. If the first decryption result matches the first random character, the gateway confirms that the first target switch possesses the first key, and the gateway's authentication of the first target switch is successful. Subsequently, the gateway uses the first key to encrypt the second random character, forming an encrypted second random character, and sends the encrypted second random character to the first target switch. If the first decryption result does not match the first random character, the first target switch fails authentication, discards the first challenge message, and terminates the authentication process.

[0037] In step S22d, the first target switch receives the encrypted second random character, and uses the first key to decrypt the encrypted second random character to obtain the second decryption result. If the second decryption result is the second random character, then the first challenge message challenge is successful, and the first target switch and the gateway establish a mutual trust relationship.

[0038] Specifically, after receiving the encrypted second random character returned by the gateway, the first target switch uses its locally stored first key to decrypt the encrypted second random character, obtaining a second decryption result. The first target switch compares the second decryption result with the second random character: if the second decryption result matches the second random character, it indicates that the gateway holds the first key, and the gateway has been authenticated by the first target switch. At this point, two-way authentication is completed between the gateway and the first target switch. Based on this, the first challenge message is successfully challenged, and a mutual trust relationship is established between the first target switch and the gateway.

[0039] In some embodiments, step S22 may also employ Hash-based Message Authentication Code (HMAC) operations for encryption and decryption. Specifically, firstly, an HMAC operation is performed on the combination of a first random character and a second random character contained in the first challenge message to generate a first verification tag. Subsequently, the first target switch sends the second random character, the first verification tag, and its own device identifier to the gateway via unicast. The gateway receives the second random character, the first verification tag, and the device identifier of the first target switch. It extracts the device identifier and retrieves the corresponding first key from its local index based on the device identifier. The gateway uses the first key to perform the same HMAC operation on the combination of the locally cached first random character and the received second random character to generate a second verification tag. The gateway compares whether the first verification tag and the second verification tag are consistent. If they are consistent, the first target switch is confirmed to have passed authentication, and an HMAC operation is performed on the concatenated combination of the second random character and a locally generated third random character to generate a third verification tag. The third random character and the third verification tag are then sent to the first target switch. If they are inconsistent, authentication fails, and the authentication process is terminated.

[0040] After receiving the third random character and the third check tag, the first target switch uses its locally stored first key to perform the same HMAC operation on the concatenated combination of the received third random character and the locally cached second random character, generating a fourth check tag. The first target switch compares the third check tag with the fourth check tag. If they match, the gateway authentication is confirmed to be successful, the first challenge message is successfully challenged, and a mutual trust relationship is established between the first target switch and the gateway. If they do not match, the message is discarded, and the authentication process is terminated.

[0041] By establishing mutual trust through unicast, the target switch can be accurately located, network redundant packets can be reduced, authentication efficiency can be improved, and false responses from irrelevant devices and interference from illegal devices can be effectively avoided, thereby enhancing the security and reliability of network access.

[0042] Continue to refer to Figure 2 In step S23, step S22 is repeated until each of at least one switch and the gateway establishes a mutual trust relationship.

[0043] Specifically, repeat step S22 until each switch completes two-way authentication with the gateway and establishes a mutual trust relationship, ensuring that all switches in the IP list establish a mutual trust relationship with the gateway.

[0044] In step S24, if the gateway does not configure the IP list of at least one switch, the gateway sends a second challenge message to at least one switch via multicast at a first preset period. The second challenge message includes a third random character, and the second target switch enables static anti-ARP spoofing function.

[0045] Specifically, if the gateway cannot obtain the IP addresses of the switches in the local area network, it cannot initiate a challenge via unicast. To authenticate all switches in the network, the gateway sends a second challenge message via multicast to at least one switch at a first preset period. A third random character is generated by the gateway on a temporary basis each time the message is sent. Furthermore, during the multicast process, not all switches that receive the second challenge message are qualified to respond. Only switches with static ARP spoofing prevention enabled are configured to respond to the second challenge message.

[0046] In step S25, at least one switch includes a second target switch, a third random character is used as a first random character, and the second target switch is used as the first target switch to execute step S22.

[0047] Specifically, when the gateway initiates a challenge using multicast, the authentication process between the gateway and each switch is the same as in unicast authentication. Therefore, the third random character is used as the first random character, and the second target switch is used as the first target switch to execute step S22. In this way, the multicast method is only listened to and responded to by switches with static anti-ARP spoofing enabled, avoiding authentication interference caused by non-target devices misresponding to challenge messages, making the authentication process more focused and efficient.

[0048] Thus, by setting independent first and second keys, this application can establish mutual trust between network devices without the need for DHCP.

[0049] Continue to refer to Figure 1 In step S3, the gateway negotiates a temporary key with at least one switch based on mutual trust.

[0050] Specifically, the gateway and switches dynamically generate temporary keys through a key negotiation algorithm. These temporary keys are session-level keys; each temporary key negotiated between the gateway and each switch is unique and valid only within the current communication session. They expire after each session ends, requiring a new temporary key to be negotiated and generated for subsequent communication. By introducing temporary keys, even if they are intercepted during communication, attackers cannot use them to decrypt historical or future communication data, thus achieving forward security and avoiding the risk of key leakage due to the long-term use of fixed keys.

[0051] In one implementation, the key negotiation algorithm employs the Diffie-Hellman key exchange algorithm. After establishing mutual trust, the gateway and the first target switch each generate a temporary private key for this session and calculate a corresponding temporary public key based on their respective temporary private keys. After exchanging temporary public keys, each party uses the other party's temporary public key and its local temporary private key to calculate the same shared secret value. Finally, both parties input the shared secret value and a random number for this session into the key derivation function to generate a temporary session key, i.e., a temporary key.

[0052] In some embodiments, the gateway shares the second key with at least one switch based on a temporary key. Specifically, after establishing a mutual trust relationship with at least one switch, the gateway shares the second key with at least one switch based on the temporary key.

[0053] In some embodiments, reference Figure 4 Step S6 is performed before step S4. Step S6 includes... Figure 4 Steps S61 to S63 in the process.

[0054] In step S61, the backplane MAC address of each of at least one switch is sent to the gateway.

[0055] Specifically, after at least one switch establishes a mutual trust relationship with the gateway, each of the at least one switch sends its backplane MAC address to the gateway. The backplane MAC address is a unique device identifier embedded in the switch hardware, used to uniquely identify the physical identity of the switch, and does not change with port variations. By using the backplane MAC address as the device identifier for the switch, the gateway can accurately distinguish each switch in the network, avoiding device identification confusion caused by a large number of frequently changing port MAC addresses.

[0056] In step S62, the gateway receives the backplane MAC address and sends the gateway's MAC address and the backplane MAC address to each switch.

[0057] Specifically, after receiving the backplane MAC addresses reported by each switch, the gateway combines its own MAC address with all the collected backplane MAC addresses to form a trusted device address list, and sends it to each switch through the established mutual trust relationship, so that each switch can know the MAC address information of other switches in the network besides itself.

[0058] In step S63, each switch receives the MAC address of the gateway and the backplane MAC address. If the interface MAC address list of each switch contains the MAC address of the gateway and / or the backplane MAC address, then the interface of each switch is an interconnection interface. If the interface MAC address list of each switch does not contain the MAC address of the gateway and the backplane MAC address, then the interface of each switch is an access interface.

[0059] Specifically, a specific embodiment is provided below to illustrate step S63, with reference to... Figure 5 If gateway interface 111 finds the MAC address of the first switch 120 and the MAC address of the second switch 130 in the interface MAC address list, then gateway interface 111 is an interconnection interface. If the first interface 121 of the first switch finds the MAC address of the gateway 110 in the interface MAC address list, then the first interface 121 of the first switch is an interconnection interface. If the second interface 122 of the first switch finds the MAC address of the second switch 130 in the interface MAC address list, then the second interface 122 of the first switch is an interconnection interface. If the first interface 131 of the second switch finds both the MAC address of the first switch 120 and the MAC address of the gateway 110 in the interface MAC address list, then the first interface 131 of the second switch is an interconnection interface. If the second interface 132 of the second switch does not find either the MAC address of the first switch 120 or the MAC address of the gateway 110 in the interface MAC address list, then the second interface 132 of the second switch is an access interface.

[0060] The above process illustrates that, for a switch, if the MAC address of the gateway and / or other switches is found in the interface MAC address list of the switch, then the switch interface is an interconnect interface. If the MAC address of the gateway and other switches is not found in the interface MAC address list of the switch, then the switch interface is an access interface. For a gateway, if the MAC address of the switch is found in the interface MAC address list of the gateway, then the gateway interface is an interconnect interface.

[0061] Continue to refer to Figure 1 In step S4, at least one switch receives a first ARP request message that claims to be from the gateway. At least one switch determines whether the first ARP request message is an ARP spoofing attack based on the temporary key. If it is determined to be an ARP spoofing attack, then step S5 is executed.

[0062] In some embodiments, reference Figure 6 Step S4 also includes Figure 6 Steps S41 to S43 in the process.

[0063] In step S41, at least one interface of the switch receives a first ARP request message claiming to be from the gateway, the first ARP request message including the source IP address and the source MAC address.

[0064] Specifically, at least one interface of the switch receives a first ARP request packet claiming to originate from the gateway. The source IP address is the IP address carried in the first ARP request packet, and the source MAC address is the MAC address of the gateway carried in the first ARP request packet.

[0065] In step S42, if the source IP address matches the gateway's IP address but the source MAC address does not match the gateway's MAC address, then at least one switch sends a first ARP challenge message to the gateway based on the temporary key.

[0066] Specifically, if the source IP address matches the gateway's IP address but the source MAC address does not match the gateway's MAC address, it indicates that the IP address carried in the first received ARP request packet matches the gateway's IP address, but the MAC address it carries is not the gateway's real MAC address. Therefore, the first ARP request packet may be an ARP spoofing attack, but it cannot be ruled out that the gateway's MAC address has been legitimately changed due to device replacement, network card changes, or primary / backup switching. Therefore, the first ARP request packet cannot be directly determined to be an ARP spoofing attack; instead, a first ARP challenge packet is sent to the gateway based on the temporary key.

[0067] In step S43, if the first ARP challenge message succeeds, it is determined that the gateway is alive and the first ARP request message is an ARP spoofing attack.

[0068] Specifically, if the first ARP challenge packet succeeds, it indicates that the gateway is currently alive. Since the gateway's real MAC address is its own MAC address, and the source MAC address carried in the first ARP request packet does not match the gateway's MAC address, and the gateway is alive, it can be determined that the first ARP request packet was not sent by the gateway, but rather by an ARP spoofing attack from another device in the network. Through this mechanism, the switch can accurately identify an ARP request packet as an ARP spoofing attack, provided that the gateway is alive, avoiding misjudgments caused by legitimate changes to the gateway's MAC address, and achieving accurate identification and interception of ARP spoofing attacks.

[0069] In step S44, if the first ARP challenge message fails, at least one switch sends a second ARP challenge message to the source MAC address. If the second ARP challenge message succeeds, at least one switch establishes a mutual trust relationship with the gateway using the source MAC address. If the second ARP challenge message fails, at least one switch disengages from the mutual trust relationship with the gateway.

[0070] Specifically, if the first ARP challenge message fails, at least one switch sends a second ARP challenge message to the source MAC address. If the second ARP challenge message succeeds, it is determined that the gateway has migrated to the source MAC address, and at least one switch establishes a mutual trust relationship with the gateway using the source MAC address, updating the gateway's MAC address stored locally to the source MAC address. If the second ARP challenge message fails, it is determined that the gateway is an unauthorized device, and at least one switch disengages from the mutual trust relationship with the gateway.

[0071] Continue to refer to Figure 1 In step S5, if at least one switch receives the first ARP request message on an access interface, the access interface is blocked and a warning is generated.

[0072] Specifically, if the interface receiving the first ARP request packet is an access interface, the switch will immediately block that access interface, cut off the connection between the attack source and the network, and generate an alarm message to report to the gateway.

[0073] In some embodiments, if the interface receiving the first ARP request packet is an access interface, and the access interface is blocked, then the interface enters a continuously monitored state. That is, the switch to which the interface belongs continues to listen for any more first ARP request packets arriving on the interface. The switch to which the interface belongs is configured with an observation time, which starts counting from when the interface is blocked. During the observation time, it continuously checks whether the interface receives the first ARP request packet again. If no first ARP request packet is detected within the observation time, it is determined that the ARP spoofing attack has stopped, and the switch to which the interface belongs automatically unblocks the interface and resumes data forwarding. If the first ARP request packet is detected again within the observation time, it is determined that the attack is still ongoing, and the switch to which the interface belongs maintains the blocked state and restarts the timer to continue monitoring. Through this mechanism, the switch to which the interface belongs can automatically restore interface communication after the attack stops, while maintaining isolation of the attack source while the attack continues.

[0074] In some embodiments, if at least one switch interface is an interconnect interface, the gateway is notified that at least one switch interface is an interconnect interface. The gateway then notifies at least one switch, which queries the interconnect interfaces using the source MAC address and blocks those interfaces. Specifically, at least one switch reports the interconnect interface information to the gateway, and this information includes at least the source MAC address. After receiving the interconnect interface information, the gateway announces the source MAC address to other switches. Upon receiving the announcement from the gateway, other switches query their respective interface MAC address lists to determine if the source MAC address exists in the MAC address list of any interface. If a switch finds the source MAC address in its interface's MAC address list, it determines that the interconnect interface is the physical port where the ARP spoofing attack is located. The switch immediately performs a blocking operation on that interconnect interface, cutting off the connection between the attack source and the network, and returns the processing result to the gateway.

[0075] In this way, the gateway centrally manages the establishment of mutual trust relationships among the switches. Each switch and terminal device independently challenges received ARP request packets based on a locally stored first or second key, identifying and intercepting the ARP request packets as soon as they enter the network. The gateway and switches work together to significantly improve the response efficiency of ARP spoofing protection in static IP network environments.

[0076] In some embodiments, reference Figure 7 The controller is also configured to perform actions such as Figure 7 Steps S7 to S11 in the process.

[0077] In step S7, at least one switch interface detects the access of the target network device and sends a third challenge message to the target network device. The third challenge message includes a fourth random character. The target network device includes one of at least one switch or one of at least one terminal device.

[0078] Specifically, after at least one interface of a switch detects the access of a target network device, it sends a third challenge message to the target network device. The third challenge message contains a fourth random character. The fourth random character is temporarily generated by the switch and is used for one-time verification of this authentication session. It is different for each authentication to prevent replay attacks.

[0079] In step S8, after receiving the third challenge message, the target network device encrypts the fourth random character using a preset key, and then sends the third response message, which includes the encrypted fourth random character, to at least one switch.

[0080] Specifically, after receiving the third challenge message, the target network device extracts the fourth random character and encrypts it using a locally preset key to obtain the encrypted fourth random character. The target network device then generates a third response message from the encrypted fourth random character and sends it to the switch.

[0081] In step S9, at least one switch receives a third response message. If at least one switch successfully decrypts and verifies the third response message using the first key, the preset key is the first key, the target network device is identified as one of the at least one switch, and the interface of the at least one switch connected to the target network device is set as an interconnection interface.

[0082] Specifically, at least one switch receives the third response message returned by the target network device and uses the locally stored first key to decrypt and verify the encrypted random characters in the third response message. If the verification is successful, i.e., the decryption result matches the originally sent fourth random character, it indicates that the preset key held by the target network device is the first key, and the target network device is identified as the switch. At this time, at least one switch sets the interface connected to the target network device as an interconnect interface.

[0083] In step S10, if at least one switch successfully decrypts and verifies the third response message using the second key, the preset key is the second key, the target network device is identified as one of at least one terminal device, and the interface of the at least one switch that connects to the target network device is set as the access interface.

[0084] Specifically, at least one switch uses a locally stored second key to decrypt and verify the encrypted random characters in the third response message. If the verification is successful, meaning the decryption result matches the originally sent fourth random characters, it indicates that the target network device holds the second key, and the target network device is identified as the terminal device. At this point, at least one switch sets the interface connected to the target network device as an access interface.

[0085] In some embodiments, if at least one switch identifies the target network device as a terminal device, and at least one switch stores the IP address and MAC address of the terminal device, at least one switch sends a second ARP request message to the terminal device. The second ARP request message includes a source IP address and a source MAC address. As mentioned above, the source IP address is the IP address of the gateway carried in the second ARP request message, and the source MAC address is the MAC address of the gateway carried in the second ARP request message. If the terminal device does not store the MAC address of the gateway locally, it records the received source MAC address from the second ARP request message as the MAC address of the gateway. If the terminal device has stored the MAC address of the gateway locally, when it receives the second ARP request message, if the source IP address is the same as the gateway IP address stored locally, but the source MAC address is different from the gateway MAC address stored locally, the terminal device sends a third ARP challenge message to the MAC address of the gateway stored locally to verify whether the gateway corresponding to the IP address stored locally by the terminal device is alive. If the terminal device receives a response from the MAC address of the gateway stored locally, it determines that the second ARP request packet is an ARP spoofing attack and discards it; if it does not receive a response from the gateway corresponding to the IP address stored locally, it determines that the gateway corresponding to the IP address of the gateway stored locally has been migrated, and records the source MAC address as the MAC address of the new gateway to ensure the continuity of communication.

[0086] In step S11, if the preset key is not recognized as the first key or the second key, the interface of at least one switch accessing the target network device is blocked, and a third challenge message is sent to the target network device according to the second preset period.

[0087] Specifically, if at least one switch fails to decrypt and verify the third response message using both the first and second keys, the target network device is determined to be an illegitimate device, and its communication interface is blocked. Simultaneously, at least one switch resends the third challenge message to the target network device according to a second preset period, providing it with a re-authentication opportunity once its key configuration is corrected or it gains authorization. If the target network device fails authentication within a preset number of attempts, at least one switch permanently blocks the interface and sends an alarm message to the gateway.

[0088] In some embodiments, when at least one access interface of a switch receives a third ARP request packet from a terminal device, the third ARP request packet includes the IP address and MAC address of the terminal device. If the IP address carried in the third ARP request packet received by the switch matches the IP address of the terminal device stored locally, but the MAC address carried in the third ARP request packet does not match the MAC address of the terminal device stored locally, then a third ARP challenge packet is sent to the MAC address of the terminal device stored locally. If the switch receives a response packet returned by the MAC address carried in the third ARP request packet, it indicates that the terminal device with the MAC address carried in the third ARP request packet is still alive, and the currently received third ARP request packet is an ARP spoofing attack. At least one switch discards the packet. Simultaneously, at least one switch determines the interface type receiving the third ARP request packet. If the interface is an access interface, at least one switch directly blocks that interface. If the interface is an interconnect interface, at least one switch reports the MAC address information carried in the third ARP request packet to the gateway. The gateway then issues a query command to all switches to query the access interface corresponding to the MAC address carried in the third ARP request packet, and instructs at least one switch that finds the access interface corresponding to the MAC address carried in the third ARP request packet to block it.

[0089] In summary, this application, through pre-configured first and second keys, enables the establishment of mutual trust relationships between network devices in a network environment with static IP address configuration, without the need for DHCP protocol involvement. Furthermore, the combination of unified identity mutual trust authentication on the gateway side and spoofing attack identification on the switch and terminal device sides effectively counters ARP spoofing attacks, significantly improving the overall coverage and response efficiency of ARP spoofing protection in static IP network environments.

[0090] This application uses specific terms to describe embodiments of the application. Terms such as "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic associated with at least one embodiment of the application. Therefore, it should be emphasized and noted that references to "an embodiment," "one embodiment," or "an alternative embodiment" in different locations throughout this specification do not necessarily refer to the same embodiment. Furthermore, certain features, structures, or characteristics in one or more embodiments of the application can be appropriately combined.

[0091] It should be noted that, in order to simplify the description of the present application and thus aid in the understanding of one or more embodiments of the invention, the foregoing description of the embodiments of the present application sometimes combines multiple features into a single embodiment, drawing, or description thereof. However, this disclosure method does not imply that the subject matter of the application requires more features than those mentioned. In fact, the embodiments contain fewer features than all the features of the single embodiments disclosed above.

[0092] In some embodiments, numbers describing the quantity of components and attributes are used. It should be understood that such numbers used to describe embodiments are sometimes modified by the terms "approximately," "approximately," or "generally." Unless otherwise stated, "approximately," "approximately," or "generally" indicates that the numbers are allowed to vary by ±20%. Accordingly, in some embodiments, the numerical parameters used in this application are approximate values, which may be changed depending on the characteristics required by individual embodiments. In some embodiments, numerical parameters should take into account specified significant digits and employ a general method of digit preservation. Although the numerical ranges and parameters used to confirm their breadth of range in some embodiments of this application are approximate values, in specific embodiments, such values ​​are set as precisely as feasible.

Claims

1. A network device based on ARP anti-spoofing, the network device being used to access a local area network, characterized in that, include: The network device includes a gateway, at least one switch, and at least one terminal device; The controller is configured to perform the following steps: S1: A first key and a second key are set in the gateway, the gateway shares the first key with the at least one switch, and the gateway shares the second key with the at least one terminal device; S2: Use the first key to establish a mutual trust relationship between the gateway and the at least one switch; S3: The gateway and the at least one switch negotiate a temporary key based on the mutual trust relationship; S4: The at least one switch receives a first ARP request packet claiming to be from the gateway. The at least one switch determines whether the first ARP request packet is an ARP spoofing attack based on the temporary key. If the determination is yes, then proceed to step S5. S5: If the interface through which the at least one switch receives the first ARP request message is an access interface, then the access interface is blocked and a warning is generated.

2. The network device based on ARP anti-spoofing as described in claim 1, characterized in that, The at least one switch includes a first target switch, and step S2 includes: S21: If the gateway configures the IP list of the at least one switch, then proceed to step S22; S22: The gateway sends a first challenge message to the first target switch. If the first challenge message is successful, the first target switch and the gateway establish a mutual trust relationship. S23: Repeat step S22 until each of the at least one switch establishes a mutual trust relationship with the gateway.

3. The network device based on ARP anti-spoofing as described in claim 2, characterized in that, Step S22 includes: S22a: The gateway sends the first challenge message to the first target switch, the first challenge message including a first random character; S22b: After receiving the first challenge message, the first target switch encrypts the first random character using the first key to form an encrypted first random character, and sends the encrypted first random character and the second random character to the gateway. S22c: The gateway uses the first key to decrypt the encrypted first random character and obtains a first decryption result. If the first decryption result is the first random character, the gateway uses the first key to encrypt the second random character to form an encrypted second random character. The gateway then sends the encrypted second random character to the first target switch. S22d: The first target switch receives the encrypted second random character. The first target switch uses the first key to decrypt the encrypted second random character and obtains a second decryption result. If the second decryption result is the second random character, then the first challenge message challenge is successful, and the first target switch establishes a mutual trust relationship with the gateway.

4. The network device based on ARP anti-spoofing as described in claim 3, characterized in that, The at least one switch includes a second target switch, and step S2 further includes: S24: If the gateway does not configure the IP list of the at least one switch, the gateway sends a second challenge message to the at least one switch via multicast at a first preset period. The second challenge message includes a third random character, and the second target switch enables static anti-ARP spoofing function. S25: Use the third random character as the first random character and the second target switch as the first target switch to execute step S22.

5. The network device based on ARP anti-spoofing as described in claim 1, characterized in that, The steps following step S3 and before step S4 include: The gateway shares the second key with the at least one switch based on the temporary key.

6. The network device based on ARP anti-spoofing as described in claim 5, characterized in that, The controller is further configured to execute step S6 before step S4, wherein step S6 includes: S61: Send the backplane MAC address of each of the at least one switch to the gateway; S62: The gateway receives the backplane MAC address and sends the gateway's MAC address and the backplane MAC address to each of the switches; S63: Each switch receives the MAC address of the gateway and the backplane MAC address. If the interface MAC address list of each switch contains the MAC address of the gateway and / or the backplane MAC address, then each switch interface is an interconnection interface. If the interface MAC address list of each switch does not contain the MAC address of the gateway and the backplane MAC address, then each switch interface is an access interface.

7. The network device based on ARP anti-spoofing as described in claim 6, characterized in that, Step S4 includes: S41: An interface of the at least one switch receives a first ARP request message claiming to be from the gateway, the first ARP request message including a source IP address and a source MAC address; S42: If the source IP address matches the IP address of the gateway, and the source MAC address does not match the MAC address of the gateway, then the at least one switch sends a first ARP challenge message to the gateway based on the temporary key; S43: If the first ARP challenge message succeeds, the gateway is determined to be alive and the first ARP request message is an ARP spoofing attack.

8. The network device based on ARP anti-spoofing as described in claim 7, characterized in that, Step S4 further includes: S44: If the first ARP challenge message fails, the at least one switch sends a second ARP challenge message to the source MAC address. If the second ARP challenge message succeeds, the at least one switch establishes the mutual trust relationship with the gateway using the source MAC address. If the second ARP challenge message fails, the at least one switch disengages from the mutual trust relationship with the gateway.

9. The network device based on ARP anti-spoofing as described in claim 8, characterized in that, Step S5 further includes: If the interface of the at least one switch is the interconnect interface, the gateway is notified that the interface of the at least one switch is the interconnect interface. The gateway then notifies the at least one switch of the information. The at least one switch queries the interconnect interface using the source MAC address and blocks the interconnect interface using the source MAC address.

10. The network device based on ARP anti-spoofing as described in claim 9, characterized in that, The controller is also configured to perform the following steps: S7: The interface of the at least one switch detects the access of the target network device in the network device and sends a third challenge message to the target network device. The third challenge message includes a fourth random character. The target network device includes one of the at least one switch or one of the at least one terminal device. S8: After receiving the third challenge message, the target network device encrypts the fourth random character using a preset key, and sends a third response message including the encrypted fourth random character to the at least one switch. S9: When the at least one switch receives the third response message, if the at least one switch successfully decrypts and verifies the third response message using the first key, the preset key is the first key, the target network device is identified as one of the at least one switch, and the interface of the at least one switch connected to the target network device is set as an interconnection interface. S10: If the at least one switch successfully decrypts and verifies the third response message using the second key, the preset key is the second key, the target network device is identified as one of the at least one terminal devices, and the interface of the at least one switch that connects to the target network device is set as an access interface. S11: If the preset key is not identified as the first key or the second key, the interface of at least one switch accessing the target network device is blocked, and the third challenge message is sent to the target network device according to the second preset period.

Images