Network Controller Address Discovery Suppression
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing address discovery messaging protocols, such as ARP and ND, can lead to security issues like unused ARP records not expiring, unlimited VM bindings, and compromised IP-to-MAC mappings, causing unnecessary network burden and requiring passive monitoring by network operators.
Innovation Solution
A secure method implemented on a cluster of network controllers that receives address discovery records, applies user-defined or pre-configured rules to evaluate and filter these records, discarding any that violate the rules to prevent unauthorized distribution and ensure secure address discovery messaging.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of energy
If address discovery messages (ARP/ND) are suppressed using existing techniques, then network broadcasting traffic is reduced, but security vulnerabilities arise including unused ARP records not expiring, unlimited VM bindings, and compromised IP-to-MAC mappings
Solution Approach 1:
The system performs preliminary actions by pre-configuring security rules and policies in the network controller before address discovery messages are processed. These rules define valid IP-MAC bindings, expiration times, and authorization criteria. When address discovery messages arrive, the controller has already established the framework for validation, enabling proactive security enforcement rather than reactive responses to security incidents.
Solution Approach 2:
The system implements feedback mechanisms where the network controller continuously monitors address discovery messages, validates them against stored rules, and updates its state based on validation results. The controller provides feedback to logical switches about which bindings are valid, which records should expire, and which messages should be suppressed. This closed-loop feedback ensures security policies are consistently applied and violations are detected and corrected.
2Ease of operation
If address discovery records are distributed to all hosts, then address discovery functionality is maintained, but network security is compromised due to unauthorized address distributions
Solution Approach 1:
The system applies local quality by distributing address discovery records selectively to specific hosts based on their authorization and need-to-know basis. Rather than universal distribution, the network controller evaluates each record against host-specific rules and policies, distributing only to authorized hosts. This localized distribution approach maintains address discovery functionality for legitimate operations while preventing unauthorized propagation of address information to potential attackers or compromised systems.
Solution Approach 2:
The network controller serves as an intermediary between address discovery message sources and network hosts. It receives address discovery records, validates them against security rules, makes authorization decisions, and selectively distributes approved records to appropriate hosts. This intermediary role filters out unauthorized distributions while maintaining legitimate address discovery functionality, preventing harmful factors from reaching endpoints while preserving necessary operational capabilities.
3Loss of energy
If ARP suppression is implemented without centralized control, then broadcasting traffic is reduced, but network operators must passively monitor security issues
Solution Approach 1:
The system implements self-service by enabling the network controller to automatically perform security monitoring, validation, and enforcement functions without requiring passive human intervention. The controller autonomously evaluates address discovery records against configured rules, detects violations, enforces security policies, and updates its state. This automation transforms security monitoring from a passive manual process into an active self-managing system that continuously protects the network while reducing broadcasting traffic through intelligent suppression.
Data Source
AI summary
Some embodiments provide a novel secure method for suppressing address discovery messaging. In some embodiments, the method receives an address discovery record that provides a network address associated with a machine connected to a network. The method then identifies a set of one or more rules for evaluating the received address discovery record to determine whether the address discovery record or its provided network address should be distributed to one or more hosts and/or devices associated with the network. The method then processes the set of rules to determine whether the received address discovery record violates a rule in the set of rules so as to prevent the distribution of its provided network address. When the address discovery record violates a rule, the method discards it in some embodiments. On the other hand, when the address discovery record does not violate any rule in the identified set of rules, the method distributes the address discovery record or its provided network address to one or more hosts and/or devices associated with the network.