LAN Switch MAC Spoofing Prevention via Interface Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Classical self-learning Ethernet switches are prone to MAC address spoofing, where a user steals and uses another user's or server's address, leading to incorrect forwarding table entries and communication disruptions, and existing solutions require complex pre-configuration of security keys.
Innovation Solution
Distinguishing between source addresses received from user and network interfaces, discarding packets with source addresses already stored on the network side, and maintaining separate tables to prevent malicious address spoofing without the need for an anti-hacker table, allowing only valid network-side learned addresses to override existing entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If standard self-learning is used in Ethernet switches, then forwarding simplicity is improved, but security against MAC address spoofing deteriorates
Solution Approach 1:
The address forwarding table is segmented into two separate tables: a first address forwarding table for storing source addresses from user interfaces, and a second address forwarding table for storing source addresses from network interfaces. This segmentation prevents MAC address spoofing by ensuring that addresses learned from the network side cannot be overwritten by addresses from user interfaces, while maintaining the simplicity of self-learning operation.
2Reliability
If security keys are pre-configured in a Hacker table, then security against spoofing is improved, but device complexity and operator intervention requirements worsen
Solution Approach 1:
The system performs self-service by automatically learning and distinguishing between user interface addresses and network interface addresses through the dual table structure. No operator intervention or pre-configuration of security keys is required. The switch autonomously prevents spoofing by comparing incoming source addresses against the appropriate table based on interface type, eliminating the need for manual Hacker table configuration.
Data Source
AI summary
Method for securing communication in a local area network switch (AN) comprising a user interface (UI) and a network interface (NI), comprises the steps of extracting a source address (MACi) from each packet received by said Local area network switch (AN) and storing said address (MACi) together with associated information into a address forwarding table (FT) comprised in said Local area network switch (AN) is characterised in that a distinction is made between source addresses received from the user interface (UI) and the network interface (NI), such that upon detecting that a source address (MACi) contained within a newly received packet at the user interface (UI) was already stored as a source address received at the network interface (NI), said newly received packet will be discarded and its source address contained therein will not be stored within said address forwarding table (FT).