HCI Managed ARP Repository for Spoofing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In hyper-converged infrastructure (HCI) systems, the frequent scaling of nodes and dynamic IP address changes increase the risk of ARP spoofing and incorrect ARP records, threatening network security and stability.
Innovation Solution
A centralized control point maintains a repository of ARP records, validating and distributing updates to ensure accurate ARP information across the system, using a management VM to collect and distribute valid ARP records through a secure channel, and providing APIs for hosts to register, update, or deregister their ARP information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If nodes frequently scale into and out of the cluster causing dynamic IP address changes, then system flexibility and scalability are improved, but the risk of ARP spoofing and incorrect ARP records increases
Solution Approach 1:
The patent introduces a centralized management system as an intermediary that maintains a trusted repository of ARP records. This mediator validates and distributes ARP records to all nodes, ensuring that even during frequent scaling operations, the ARP information remains authoritative and cannot be spoofed. The intermediary decouples the scalability benefit from the security risk by centralizing trust.
Solution Approach 2:
The system implements feedback mechanisms where nodes report their IP address changes to the centralized management system, which then updates the repository and redistributes the corrected ARP records. This closed-loop feedback ensures that dynamic IP changes are immediately reflected in the trusted ARP database, maintaining security while allowing flexibility.
2Reliability
If a centralized repository of ARP records is maintained and validated, then ARP spoofing protection is improved, but system complexity increases
Solution Approach 1:
The patent merges the ARP record management functionality into the existing centralized management infrastructure (such as the vCenter or HCI management plane). By combining ARP repository management with existing management duties, the system avoids duplicating infrastructure and reduces overall complexity while still providing centralized ARP validation and distribution.
3Stability of the object's composition
If ARP records are validated and distributed through a centralized system, then network stability is improved, but the time required for ARP record updates increases
Solution Approach 1:
The system performs preliminary actions by pre-establishing the centralized ARP repository and configuring all nodes to trust and query this central source before ARP spoofing can occur. By having the validation infrastructure in place beforehand, the system eliminates the need for time-consuming detection and correction of spoofed ARP records, as validation happens proactively at the source.
Data Source
AI summary
An information handling system may include at least one processor and a memory. The information handling system may be configured to: maintain a repository of address resolution protocol (ARP) records for a plurality of information handling systems; and in response to a request from one of the plurality of information handling systems to update a record in the repository: validate the request; update the record; and distribute the updated record to at least some of the plurality of information handling systems.