Access Node Filter Module for Ethernet Spoofing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In public Ethernet networks, user identification is challenging due to the lack of technical barriers against IP and MAC address spoofing, leading to security issues that rely on mutual trust and administrative rules, which are inefficient and costly.
Innovation Solution
An access node with a filter module that stores address information and verifies the destination and source addresses of data packets, ensuring only legitimate packets are transmitted to their intended recipients, preventing fraudulent address manipulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If address verification filtering is implemented at access nodes, then network security against spoofing is improved, but device complexity increases
Solution Approach 1:
The access node performs preliminary verification of source and destination addresses against stored valid address information before packets are routed through the network. This prevents spoofed packets from entering the network in the first place, maintaining security without requiring complex ongoing monitoring mechanisms throughout the network infrastructure.
Solution Approach 2:
The security function is segmented and localized to individual access nodes rather than requiring centralized control or modification of core network switches. Each access node independently maintains a table of valid addresses and filters packets locally, distributing the security function across multiple simple nodes rather than one complex centralized system.
2Reliability
If all traffic is routed through central nodes for security monitoring, then network security is improved, but traffic flow efficiency deteriorates
Solution Approach 1:
Security filtering is applied locally at each access node where packets enter the network, rather than requiring all packets to be routed to central monitoring nodes. Packets are verified against locally stored address information and forwarded directly through the network using standard routing, maintaining both security and traffic flow efficiency.
3Reliability
If address verification is performed on all packets, then security against spoofing is improved, but processing time increases
Solution Approach 1:
The verification process extracts only the source and destination addresses from packet headers and compares them against compact tables of valid address information. This selective extraction and comparison of only critical address fields, rather than analyzing entire packets, minimizes processing time while maintaining effective security verification.
Data Source
AI summary
A method and access node for preventing spoofing while connecting subscribers to an Ethernet network. The access node includes a filter mechanism for filtering packets destined to subscribers attached to the access node. The filter mechanism includes a database of allocated IP destination addresses and MAC addresses. The filter mechanism blocks any packet directed to a subscriber but containing an incorrect IP or MAC address. The mechanism prevents users from changing their address information to illegally appropriate packets from other users or to disguise their identity.