IP Filter Device Dynamic DHCP Binding for Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In IP networks, illegitimate use of IP addresses is difficult to track and prevent, as subscribers can misuse allocated or unallocated addresses, making abuse investigations challenging, and existing solutions require manual filter updates which are prone to errors.
Innovation Solution
An IP filter device that dynamically updates subscriber IP addresses and their lease times, only allowing trusted DHCP servers to allocate addresses, and counts illegitimate attempts to prevent misuse, ensuring only legitimate IP addresses are used.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual filter updates are used to prevent illegitimate IP address usage, then network security is improved, but device complexity and human error increase
Solution Approach 1:
The IP filter device automatically updates its own filter rules by receiving IP address allocation information from the DHCP server. The device monitors DHCP communications and dynamically creates filter entries without requiring manual operator intervention, thereby improving reliability while reducing complexity and human error.
Solution Approach 2:
The system establishes a feedback loop where the IP filter device continuously receives information about allocated IP addresses from the DHCP server and automatically adjusts its filtering rules accordingly. This real-time feedback mechanism ensures the filter remains current with network changes without manual updates.
2Adaptability or versatility
If dynamic IP address allocation is allowed, then network adaptability is improved, but tracking and preventing abuse becomes more difficult
Solution Approach 1:
The IP filter device performs preliminary actions by pre-configuring filter rules based on DHCP server allocations before any potential abuse can occur. By proactively establishing which IP addresses are legitimately in use and creating corresponding filter entries, the system maintains adaptability to dynamic allocations while preventing abuse from the outset.
Solution Approach 2:
The IP filter device acts as an intermediary between the DHCP server and network traffic. It receives allocation information from the DHCP server and uses this information to mediate traffic flow by automatically blocking packets with illegitimate source IP addresses, thus maintaining both adaptability and abuse tracking capability.
3Reliability
If IP addresses are allocated by multiple DHCP servers, then service availability is improved, but ensuring legitimate address usage becomes more complex
Solution Approach 1:
The IP filter device is designed with universal functionality to work with multiple different DHCP servers simultaneously. It can receive and process DHCP allocation information from any authorized server in the network, creating a unified filtering mechanism that handles diverse server sources without increasing operational complexity.
Data Source
AI summary
Illegitimate use of IP addresses is counteracted. A network (1) includes a switch (5) with ports (P1,P2,P3) to subscribers (6,6A) and a port (PN) to a core network (2) with DHCP servers (4, 4a,4b). The switch includes a database (MAC1, MAC2), port numbers (P1, P2) and VLAN identities (VLAN1, VLAN2) for the subscribers (6, 6A) and the filter has a list over trusted DHCP servers. Initially only DHCP messages from the subscribers are allowed. When the subscriber (6) requests (M1, M3) for an IP address it is checked that it is a DHCP message with valid subscriber values (MAC1, P1, VLAN1). A respond (M2, M4) with an allocated IP address (IP1) and lease time interval (T1) is checked to come from a trusted DHCP server. If so, a list in the filter (9) with correct information is dynamically generated (MAC1, P1, VLAN1, IP1, T1). A message (M5) from the subscriber (6) with false IP address is discarded by the filter. Attempts by the subscriber to use false IP address are counted and a warning signal is generated.