SDN Controller ARP Response Handling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In traditional networks, managing ARP traffic is complex and prone to security risks like ARP spoofing, and it leads to high bandwidth utilization due to broadcasted ARP requests.
Innovation Solution
Implementing a system in SDN that allows switches to either respond on behalf of devices or block ARP requests based on communication flows, reducing the need for broadcasted ARP requests and enhancing security by centralizing ARP response handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ARP requests are broadcasted in traditional networks, then all devices can receive and respond to ARP requests, but bandwidth utilization increases and security risks arise
Solution Approach 1:
The patent extracts the ARP response function from individual end devices and centralizes it in the SDN controller. The controller maintains an address store with MAC-to-IP mappings and directly responds to ARP requests on behalf of devices, eliminating the need for devices to broadcast ARP requests and reducing bandwidth consumption while improving security through centralized control
Solution Approach 2:
The SDN controller acts as an intermediary between ARP requests and end devices. When an ARP request is received, the controller intercepts it, queries its address store, and returns the appropriate response without allowing the request to propagate as a broadcast across the network, thereby reducing bandwidth usage and preventing ARP spoofing
2Ease of operation
If ARP requests are broadcasted to resolve addresses, then address resolution can be achieved, but network traffic increases unnecessarily
Solution Approach 1:
The SDN controller performs preliminary actions by maintaining an address store that pre-contains MAC-to-IP address mappings for all devices in the network. When an ARP request is received, the controller can immediately retrieve the answer from its pre-populated database without needing to broadcast or wait for responses, thus resolving addresses efficiently with minimal network traffic
3Adaptability or versatility
If traditional ARP handling is used, then devices can communicate freely, but security vulnerabilities like ARP spoofing increase
Solution Approach 1:
The system implements feedback control by having the SDN controller monitor ARP requests, validate them against its address store, and selectively permit or block responses. This feedback mechanism ensures that only legitimate ARP responses are generated, preventing ARP spoofing while maintaining necessary communication freedom between authorized devices
Data Source
AI summary
The present disclosure pertains to systems and methods of handling Address Resolution Protocol (ARP) responses in a software defined network (SDN). In one embodiment, a system may comprise a controller in a control plane to generate an address store comprising information associated with a plurality of devices in communication with the SDN. The controller may also program a plurality of network devices in a data plane based on a plurality of communication flows. The network devices may forward traffic according to the plurality of communication flows received from the controller. The network device may also receive: a request from the first device for information associated with the second device, determine that the first device is authorized to communicate with the second device based on the plurality of communication flows, and generate a response to the request comprising the information associated with the second device based on the address store.