IoT Network Intrusion Detection via MAC-DHCP Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secured networks face challenges in detecting intruder devices that spoof the MAC address of known good devices, compromising network security, especially in distributed environments where devices may travel between multiple locations.
Innovation Solution
A centralized cloud service is utilized to manage and secure devices across multiple locations by comparing MAC addresses with DHCP options, allowing access only if they sufficiently match, and quarantining or denying access if there is a mismatch.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If MAC address spoofing is allowed for IoT devices, then device access to network is enabled, but network security is compromised by intruder devices
Solution Approach 1:
The system performs preliminary authentication by comparing DHCP options against a database of known legitimate device profiles before granting network access. This preliminary verification ensures that only authenticated devices can connect, preventing spoofing attacks while maintaining ease of access for legitimate devices.
Solution Approach 2:
The system continuously monitors network traffic and provides feedback by comparing observed DHCP options against stored profiles. When mismatches are detected indicating potential spoofing, the system automatically responds with denial of service or alerting, creating a closed-loop security mechanism that maintains both accessibility and security.
2Reliability
If DHCP information is prevented from being shared outside internal network, then network security is maintained, but centralized device management across multiple locations is hindered
Solution Approach 1:
The system extracts only the essential authentication data (MAC address and DHCP options) from the full DHCP information stream and transmits this minimized dataset to the centralized cloud service. This extraction allows security verification across locations without sharing sensitive internal network information, resolving the contradiction between security and distributed management.
Solution Approach 2:
The cloud service acts as an intermediary that receives DHCP information from multiple locations, performs centralized authentication by comparing against stored profiles, and returns authentication decisions to the local networks. This intermediary architecture enables distributed device management while maintaining network security through centralized verification.
3Reliability
If centralized cloud service is used for device authentication, then security against mobile attackers is improved, but system complexity increases
Solution Approach 1:
The system creates a simplified copy of the authentication process that can be executed locally by comparing DHCP options against pre-stored profiles in a database. This copying approach allows the complex centralized authentication logic to be replicated at edge devices, reducing the complexity burden on any single location while maintaining high security through centralized profile management.
Data Source
AI summary
A system and method for detecting an intruder in a network is provided. An authentication request can be received by a network including a MAC address from an IoT device, and the MAC address can be authenticated. A request can be received for an IP address via DHCP including a DHCP option from the IoT device, and a determination made as to whether the MAC address and the DHCP options sufficiently match. If there is match, access can be allowed to the IoT device and if not output the mismatch.