Hypervisor DHCP Request Filtering for Rogue Client Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Dynamic Host Configuration Protocol (DHCP) lacks strong authentication mechanisms to distinguish between legitimate and rogue DHCP clients, leading to potential denial-of-service attacks that can exhaust IP address pools and disrupt network communications.
Innovation Solution
A hypervisor in a software-defined networking environment monitors DHCP requests from virtual machines, implementing soft and hard count restrictions based on sub-interfaces and unique client identifiers to filter out rogue requests, and applies value restrictions by replacing client identifiers with unique ones, thereby securing the DHCP server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the DHCP server accepts all DHCP requests without authentication, then legitimate clients can obtain IP addresses, but rogue clients can exhaust the IP address pool and disrupt network communications
Solution Approach 1:
The patent introduces a hypervisor as an intermediary layer between the DHCP server and virtual machine clients. The hypervisor monitors and controls DHCP requests by comparing client identifiers against a maintained mapping of valid identifiers, thereby protecting the DHCP server from rogue clients while allowing legitimate requests to pass through unchanged
2Reliability
If the DHCP server implements strong authentication mechanisms, then rogue clients can be distinguished from legitimate clients, but the complexity of the DHCP protocol increases
Solution Approach 1:
The hypervisor acts as a mediator that implements authentication logic separately from the DHCP server. It maintains a mapping of valid client identifiers and performs authentication checks on DHCP requests before they reach the server, thereby providing strong authentication without modifying the DHCP protocol itself
Solution Approach 2:
The authentication function is segmented from the DHCP server into a separate hypervisor component. This division allows the DHCP server to remain simple and protocol-compliant, while the hypervisor handles the complex authentication and monitoring tasks independently
3Reliability
If the hypervisor monitors all DHCP requests from virtual machines, then rogue requests can be identified, but the processing overhead on the hypervisor increases
Solution Approach 1:
The hypervisor performs preliminary actions by maintaining an upfront mapping of valid client identifiers to virtual machine identifiers. This pre-established reference allows for efficient O(1) lookup operations when monitoring DHCP requests, significantly reducing processing overhead compared to analyzing each request in isolation
Solution Approach 2:
The hypervisor creates and maintains a copy of valid client identifier mappings in memory, allowing for rapid comparison against incoming DHCP requests. This copied reference structure enables efficient authentication checks without requiring complex real-time analysis of each request
Data Source
AI summary
An approach for securing a DHCP server against unauthorized client attacks in a SDN environment is presented. In an embodiment, a method comprises: determining a count of sub-interfaces implemented on an interface card of a virtual machine; setting a count of unique client identifiers for the virtual machine to zero; determining whether a dynamic host configuration protocol (DHCP) request has been received from the virtual machine; in response to determining that a DHCP request has been received from the virtual machine, incrementing the count of unique client identifiers; determining whether the count of unique client identifiers exceeds the count of sub-interfaces implemented on the interface card of the virtual machine; and in response to determining that the count of unique client identifiers does not exceed the count of sub-interfaces implemented on the interface card of the virtual machine, forwarding the DHCP request to an uplink port.