ARP Packet Processing via Forwarding Plane Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network technologies are vulnerable to ARP-based attacks, such as address spoofing and ARP Denial of Service (DoS), due to limitations in processing high-traffic ARP packets, which overwhelm the control plane CPU and allow unauthorized address mappings and packet forwarding to erroneous physical addresses.
Innovation Solution
An ARP packet processing method that employs a forwarding plane processor to judge the type of ARP packets, respond to valid ARP requests directly from the ARP table, and report or discard ARP responses based on permission indicators in the table, thereby preventing address spoofing and high-traffic attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If ARP packets are processed on the control plane CPU, then comprehensive ARP functionality is achieved, but the CPU becomes overloaded and crashes under high traffic attacks
Solution Approach 1:
The patent segments ARP packet processing into two distinct paths: control plane for legitimate ARP requests and forwarding plane for ARP responses. This segmentation allows the high-speed forwarding plane to handle ARP response traffic independently, preventing CPU overload while maintaining comprehensive ARP functionality.
Solution Approach 2:
The patent introduces a forwarding plane processor as an intermediary component that handles ARP response packets. This intermediary absorbs the high-traffic ARP response load that would otherwise overwhelm the control plane CPU, enabling the system to maintain stability under attack conditions.
2Speed
If ARP requests are responded to directly on the forwarding plane, then high-speed processing is achieved, but address spoofing attacks cannot be prevented
Solution Approach 1:
The patent applies different processing qualities to different ARP packet types: ARP requests are processed locally on the forwarding plane for high-speed response, while ARP responses undergo validation against the ARP table before processing. This local quality differentiation maintains speed for requests while ensuring accuracy for responses.
Solution Approach 2:
The patent implements feedback mechanism where ARP responses are validated against the ARP table entries before processing. This feedback loop checks whether the responding device is authorized to send ARP responses, preventing address spoofing attacks while maintaining efficient processing.
3Ease of operation
If ARP packets with legal IP addresses are processed, then normal communication is maintained, but address spoofing attacks using legal addresses cannot be detected
Solution Approach 1:
The patent uses feedback validation where ARP responses are checked against the ARP table to verify authorization. This feedback mechanism detects address spoofing attacks even when attackers use legal IP addresses, as the validation process checks whether the responding device is authorized to send responses for the given IP address.
Solution Approach 2:
The patent applies preliminary anti-action by validating ARP responses against the ARP table before processing them. This preventive check detects and blocks address spoofing attacks in advance, preventing unauthorized address mappings from being installed in the ARP table.
4Productivity
If high-traffic ARP packets are sent to overwhelm the control plane, then ARP DoS attack is achieved, but the system lacks protection mechanisms
Solution Approach 1:
The patent segments ARP traffic handling so that high-traffic ARP responses are processed on the forwarding plane rather than the control plane. This segmentation creates a dedicated path for ARP response processing that is insulated from DoS attacks, maintaining system security while allowing high productivity in legitimate ARP operations.
Solution Approach 2:
The forwarding plane processor serves as an intermediary that absorbs high-traffic ARP response packets, protecting the control plane from DoS attacks. This intermediary layer handles the bulk of ARP response traffic, preventing attackers from overwhelming the control plane CPU.
Data Source
AI summary
An Address Resolution Protocol (ARP) packet processing method. a communication system and a device are disclosed. The method includes: receiving an ARP packet, and judging the type of the ARP packet; when the ARP packet is an ARP request, responding to the ARP request if an entry corresponding to the ARP request is found in a local ARP table; and when the ARP packet is an ARP response. reporting the ARP response if an entry corresponding to the ARP response is found in the local ARP table and a reporting parameter in the entry indicates permission of reporting; or discarding the ARP response if no entry corresponding to the ARP response is found in the ARP table.