Spoofguard Agent IP Validation for VM Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current datacenters and enterprises face risks of IP address spoofing by virtual machines, which can be used for illicit activities such as distributed denial of service attacks, due to the inability to accurately identify and validate the source IP addresses of packets.
Innovation Solution
Implementing a spoofguard agent on each host machine that inspects outgoing IP packets from virtual machines to determine legitimate source IP addresses, using methods such as static IP address provisioning, trust on first use systems, and DHCP allocation, and blocking packets with counterfeit source IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If virtual machines are deployed on host machines in datacenters or enterprises, then computing resources can be efficiently utilized and multiple tenants can share infrastructure, but the risk of IP address spoofing increases allowing malicious activities such as distributed denial of service attacks
Solution Approach 1:
The patent introduces a proxy as an intermediary component deployed on each host machine between the virtual machines and the physical network interface. This proxy intercepts outgoing IP packets from virtual machines, validates the source IP address against the virtual machine's legitimate MAC address, and blocks spoofed packets before they reach the physical network. This intermediary mechanism enables secure IP address validation without requiring changes to the virtual machine infrastructure or network equipment.
2Reliability
If IP packets are inspected to validate source IP addresses, then spoofed packets can be blocked, but network traffic processing complexity and overhead increase
Solution Approach 1:
The patent implements preliminary binding of IP addresses to MAC addresses during virtual machine provisioning or DHCP lease assignment. The spoofguard agent learns and stores the legitimate IP-MAC mappings before packets are sent. When packets are inspected, the validation process is simplified to a direct comparison against pre-stored bindings rather than complex real-time analysis, reducing processing overhead while maintaining high reliability in detecting spoofed packets.
Data Source
AI summary
A method of blocking spoofed packets. The method receives an address allocation message from an address provisioning server that provisions addresses for virtual machines. The address allocation message includes a source address. The method stores the source address of the address allocation message. The method forwards the address allocation message to a virtual machine. The method receives, from the virtual machine, a packet with a second source address. When the second source address is the same as the first source address, the method allows the packet to be forwarded. When the second source address is not the same as the first source address, the method blocks the second packet. An additional method determines the first source address from an initial packet sent from the virtual machine instead of the address allocation method.