SDN Host Database for Man-in-the-Middle Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for preventing man-in-the-middle attacks in software defined networks, such as Dynamic ARP Inspection and DHCP snooping, are ineffective for overlay networks as they rely on a trusted port model that is not applicable in these deployments, leaving them vulnerable to internal attacks like ARP spoofing and cache poisoning.
Innovation Solution
A centralized host database on SDN controllers verifies the authenticity of hosts by comparing ARP packets, allowing only validated communications and dropping packets from unverified sources, thereby preventing internal man-in-the-middle attacks without the need for traditional trusted/untrusted port listings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ARP inspection and DHCP snooping are used, then network security is improved, but they cannot operate for overlay networks because all overlay communications happen over a NVE
Solution Approach 1:
The patent introduces a centralized controller as an intermediary that maintains a host database and verifies ARP packets. This mediator sits between the overlay network devices and the traditional security mechanisms, translating overlay communications into a form that can be verified against the centralized host database, thus enabling security inspection in overlay networks where traditional trusted port models cannot be applied.
2Reliability
If a centralized host database verification system is implemented, then internal man-in-the-middle attacks are prevented, but the system complexity increases compared to traditional trusted port models
Solution Approach 1:
The patent merges the host verification functionality into a centralized controller that consolidates the host database and verification logic. Instead of distributing complex verification mechanisms across multiple network devices, the system combines these functions in a single centralized point, reducing overall system complexity while maintaining strong security against man-in-the-middle attacks.
3Measurement precision
If ARP packet verification is performed for every communication, then authentication accuracy is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary actions by maintaining a pre-populated host database that contains authorized host information before ARP verification is needed. When an ARP packet arrives, the system quickly checks against this pre-prepared database rather than performing complex real-time verification, thus maintaining high authentication accuracy while minimizing processing time delays.
Data Source
AI summary
Systems, methods, and computer-readable media for preventing man-in-the-middle attacks within network, without the need to maintain trusted/un-trusted port listings on each network device. The solutions disclosed herein leverage a host database which can be present on controllers, thereby providing a centralized database instead of a per-node DHCP binding database. Systems configured according to this disclosure (1) use a flood list only for ARP packets received from the controller 116; and (2) unicast ARP packets to the controller before communicating the packets to other VTEPs.