Blocking Server Defends Against ARP Spoofing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to effectively detect and prevent ARP spoofing attacks in networks, as they rely on filtering operations using local network addresses rather than individual IP addresses, making it difficult to identify and counter ARP spoofing.
Innovation Solution
A spoofing attack defense method using a blocking server that checks IP and MAC addresses in ARP packets and maintains blocked and allowed address lists to identify and block spoofing attacks in real-time by clients and the server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If filtering operation is performed using local network address instead of individual IP address, then the filtering operation can be simplified, but the ability to detect and prevent ARP spoofing attacks is lost
Solution Approach 1:
The patent divides the network into multiple VLANs (Virtual Local Area Networks) and creates separate ARP tables for each VLAN. This segmentation allows individual IP address filtering within each VLAN while maintaining manageable complexity through structured organization. The blocking server maintains separate allowed IP-MAC address lists for different VLANs, enabling precise spoofing detection without overwhelming complexity.
Solution Approach 2:
The blocking server acts as an intermediary between clients and the network. It receives ARP packets from clients, checks them against the allowed IP-MAC address lists, and blocks suspicious packets. This intermediary approach centralizes the complex filtering logic, allowing clients to use simple filtering while maintaining high reliability through the blocking server's verification process.
2Measurement precision
If the blocking server checks all ARP packets centrally, then spoofing detection accuracy is improved, but the server load increases
Solution Approach 1:
The blocking server pre-generates allowed IP-MAC address lists for each VLAN and distributes them to clients before actual ARP traffic occurs. Clients use these pre-computed lists to quickly filter ARP packets locally, reducing the need for centralized checking of every packet. This preliminary action maintains high detection accuracy while significantly reducing server load during normal operation.
Solution Approach 2:
The system implements a two-layer filtering approach where clients perform partial filtering using local allowed IP-MAC address lists, and the blocking server performs additional verification only when needed. This partial action at the client level reduces server load, while the server retains the capability for excessive checking when security concerns arise, balancing accuracy and performance.
3Reliability
If individual IP address filtering is implemented for each host, then spoofing detection capability is improved, but the complexity of network configuration increases
Solution Approach 1:
The blocking server provides a universal solution that handles individual IP address filtering for all hosts in the network through a centralized interface. Instead of requiring each host to be individually configured with complex filtering rules, the blocking server universally applies filtering based on VLAN and IP-MAC address lists, simplifying overall network configuration while maintaining high spoofing prevention capability.
Solution Approach 2:
The system performs preliminary configuration by automatically generating allowed IP-MAC address lists for each VLAN and distributing them to clients before deployment. This preliminary action eliminates the need for manual individual host configuration, reducing network configuration complexity while enabling precise individual IP address filtering for spoofing detection.
Data Source
AI summary
The present invention relates to a method of defending against a spoofing attack using a blocking server, and more particularly, to a method of defending against a spoofing attack using a blocking server, which is characterized in that it involves inspecting an IP and MAC address included in an ARP packet received by a client in a network, and changing the addresses to a legitimate IP address and to a corresponding MAC address when the addresses are found to be used in a spoofing attack. According to the present invention, in the blocking of a spoofing attack against a network, an IP address and a MAC address for legitimate hardware connected to the network may be prestored and monitored, so as to exhibit the effect of an accurate defense being enabled in a short time.