Proxy ARP Detection in Secure Embedded Networks

Solution Overview

Problem

In secure networks with embedded process controllers, the unintended re-enablement of proxy ARP can lead to communication loss between subnets, as the router may inadvertently respond to ARP requests with its own MAC address instead of the embedded controller's, causing packets to be misrouted and resulting in a loss of view or control.

Innovation Solution

A method to detect the presence of proxy ARP agents by identifying a test IP address, obtaining its associated MAC address, and comparing it to the range of MAC addresses for embedded controllers, generating an alarm if it falls outside the expected range, prompting corrective action to disable proxy ARP.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If proxy ARP is enabled on the router, then machines in one subnet can reach machines on remote subnets without reconfiguring routing, but the embedded controller becomes unreachable and communication loss occurs

Engineering Contradiction:

Improvesubnet reachabilityVSAvoidcommunication reliability

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary detection of proxy ARP conditions by sending test ARP requests and analyzing responses before actual communication failures occur. This allows the system to identify when the router is incorrectly responding to ARP requests and take corrective action before communication is lost.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements continuous monitoring with feedback loops that detect ARP responses, analyze MAC address associations, and trigger alerts when proxy ARP is detected. This feedback mechanism ensures the system can respond to changing network conditions and maintain communication reliability.

Inventive Principle:

Principle #23Feedback

2Adaptability or versatility

If the router configuration is changed or rebooted, then network reconfiguration may occur, but proxy ARP may be inadvertently re-enabled causing communication loss

Engineering Contradiction:

Improvenetwork reconfigurabilityVSAvoidconfiguration stability

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary detection of proxy ARP conditions by sending test ARP requests and analyzing responses before actual communication failures occur. This allows the system to identify when the router is incorrectly responding to ARP requests and take corrective action before communication is lost.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements continuous monitoring with feedback loops that detect ARP responses, analyze MAC address associations, and trigger alerts when proxy ARP is detected. This feedback mechanism ensures the system can respond to changing network conditions and maintain communication reliability.

Inventive Principle:

Principle #23Feedback

3Reliability

If static routes are added to enable inter-subnet communication, then embedded controllers become reachable, but proxy ARP can still interfere and cause ARP cache poisoning

Engineering Contradiction:

Improveinter-subnet connectivityVSAvoidARP cache poisoning

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary detection of proxy ARP conditions by sending test ARP requests and analyzing responses before actual communication failures occur. This allows the system to identify when the router is incorrectly responding to ARP requests and take corrective action before communication is lost.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements continuous monitoring with feedback loops that detect ARP responses, analyze MAC address associations, and trigger alerts when proxy ARP is detected. This feedback mechanism ensures the system can respond to changing network conditions and maintain communication reliability.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS8351340B2Method for detecting a proxy ARP agent in secure networks having embedded controllers

Publication Date: 2013.01.08 HONEYWELL INTERNATIONAL INC

AI summary

A method for detecting a proxy Address Resolution Protocol (ARP) agent in a network including at least a first machine with an IP address in a range of a first subnet, and at least one embedded controller with an IP address in a range of a second subnet. A router is also provided, wherein the second subnet is not contactable through the router provided its proxy ARP is disabled. The first machine and second machine each have static routes for inter-subnet communications. A test IP address is identified by the first machine. A test Media Access Control (MAC) address corresponding to the test IP address is then obtained. The test MAC address is compared to a range of MAC addresses for the embedded controller. An alarm is generated at the first machine if the test MAC address is outside the range of MAC addresses that can prompt actions to remove the proxy ARP condition.