Secure DHCP processing for layer two access networks
View Patent ↗In general, this disclosure describes network security techniques that may accommodate legitimate movement of a subscriber device while preventing MAC collisions that may result from configuration errors or MAC spoofing attempts. MAC spoofing may result in packets directed to one subscriber device being sent instead to another subscriber device. By modifying an access node or a Dynamic Host Configuration Protocol (DHCP) server to allow only authorized subscriber devices on the access network, layer two collisions (“MAC collisions”) may be prevented.
1. A method comprising:
receiving a data unit at a network device, the data unit including a layer two address for a subscriber device; and determining when the subscriber device has been assigned a layer three address by a layer 3 address server;
when the subscriber device has been assigned the layer three address by the layer 3 address server, then:
storing, in a memory device, an association between the layer two address of the subscriber device and the layer three address assigned to the subscriber device; and
admitting the subscriber device on an interface of the network device based on the assignment of the layer three address; and wherein the network device does not store an association for the subscriber device when the subscriber device has not been assigned the layer three address by the layer 3 address server such that the network device does not learn on the data unit until a layer three address has been assigned to the subscriber device.
2. The method of claim 1 , wherein the subscriber device is a first subscriber device, wherein the interface is a first interface, and wherein the association between layer two address of the first subscriber device and the layer three address assigned to the first subscriber device is stored in a table, the method further comprising:
storing, for each of a plurality of subscriber lines, an association between a plurality of layer two addresses and a plurality of layer three addresses in the table;
comparing a layer two address and a layer three address of a second subscriber device attempting to connect to the network device with the plurality of layer two addresses and the plurality of layer three addresses in the table;
if the first subscriber device and the second subscriber device share the same layer two address but have different layer three addresses, then denying admittance to the second subscriber device based on the comparison; and
if the first subscriber device and the second subscriber device share the same layer two address and share the same layer three address, then admitting the second subscriber device on a second interface based on the comparison.
3. The method of claim 2 , wherein admitting the second subscriber device further comprises:
removing the layer two address and the layer three address of the first subscriber device from the table; and
adding the layer two address and the layer three address of the second subscriber device and the second interface to the table.
4. The method of claim 3 , further comprising:
informing an operator if the first subscriber device and the second subscriber device share the same layer two address but have different layer three addresses; and
dropping a Dynamic Host Configuration Protocol (DHCP) offer to the second subscriber device.
5. The method of claim 1 , further comprising:
probing the network to determine whether a layer three address is in use before admitting the subscriber device on the interface of the network device.
6. The method of claim 5 , wherein probing the network comprises:
transmitting a data unit using a ping utility to the layer three address; and
determining whether a reply data unit is received from the layer three address in response to the ping utility.
7. The method of claim 1 , wherein the network device is a first network device, the method further comprising:
protecting a table in a second network device by configuring the first network device as a layer three relay agent.
8. The method of claim 1 , wherein the network device is a first network device, the method further comprising:
protecting a table in a second network device by configuring the first network device to act as a layer two relay agent; and
providing a dedicated Virtual Local Area Network (VLAN) for transmitting Dynamic Host Configuration Protocol (DHCP) data unit traffic, wherein the VLAN comprises the first network device, the second network device, and a third network device, and wherein the third network device is in communication with a DHCP server.
9. The method of claim 8 , wherein the first network device is an access node, the second network device includes a layer two switch, and the third network device includes a layer three router.
10. The method of claim 9 , wherein the access node is part of an access network.
11. A network device comprising a control unit configured to:
receive a data unit comprising a layer two address for a subscriber device;
determine when the subscriber device has been assigned a layer three address by a layer 3 address server; when the subscriber device has been assigned the layer three address by the layer 3 address server, then: store, in a memory device, an association between the layer two address of the subscriber device and the layer three address assigned to the subscriber device; and admit the subscriber device on an interface of the network device based on the assignment of the layer three address; and
wherein the network device does not store an association for the subscriber device when the subscriber device has not been assigned the layer three address by the layer 3 address server such that the network device does not associate the layer two address in the data unit with the interface of the network device coupled to the subscriber device until a layer three address has been assigned to the subscriber device.
12. The network device of claim 11 , wherein the subscriber device is a first subscriber device, wherein the interface is a first interface, and wherein the association between the layer two address of the first subscriber device and the layer three address assigned to the first subscriber device is stored in a table, wherein the control unit is further configured to:
store, for each of a plurality of subscriber lines, an association between a plurality of layer two addresses and a plurality of layer three addresses in the table; and
compare a layer two address and a layer three address of a second subscriber device attempting to connect to the network device with the plurality of layer two addresses and the plurality of layer three addresses in the table;
if the first subscriber device and the second subscriber device share the same layer two address but have different layer three addresses, then deny admittance to a second subscriber device based on the comparison; and
if the first subscriber device and the second subscriber device share the same layer two address and share the same layer three address, then admit the second subscriber device on a second interface based on the comparison.
13. The network device of claim 12 , wherein the control unit is further configured to:
remove the layer two address and the layer three address of the first subscriber device from the table; and
add the layer two address and the layer three address of the second subscriber device and the second interface to the table.
14. The network device of claim 13 , wherein the control unit is further configured to:
inform an operator if the first subscriber device and the second subscriber device share the same layer two address but have different layer three addresses; and
drop a Dynamic Host Configuration Protocol (DHCP) offer to the second subscriber device.
15. The network device of claim 11 , wherein the control unit is further configured to:
probe the network to determine whether a layer three address is in use before admitting the subscriber device on the interface of the network device.
16. The network device of claim 15 , wherein the control unit configured to probe the network is configured to:
transmit a data unit using a ping utility to the layer three address; and
determine whether a reply data unit is received from the layer three address in response to the ping utility.
17. The network device of claim 11 , wherein the network device is a first network device, and wherein the control unit is further configured to:
protect a table in a second network device by configuring the first network device as a layer three relay agent.
18. The network device of claim 11 , wherein the network device is a first network device, and wherein the control unit is further configured to:
protect a table in a second network device by configuring the first network device as a layer two relay agent; and
provide a dedicated Virtual Local Area Network (VLAN) for transmitting Dynamic Host Configuration Protocol (DHCP) data unit traffic, wherein the VLAN comprises the first network device, the second network device, and a third network device, and wherein the third network device is in electrical communication with a DHCP server.
19. A non-transitory computer-readable storage medium comprising instructions encoded on the computer-readable medium that, upon execution, cause a processor within a network device to: receive a data unit, the data unit including a layer two address for a subscriber device; and determine when the subscriber device has been assigned a layer three address by a layer 3 address server;
when the subscriber device has been assigned the layer three address by the layer 3 address server, then: store, in a memory device, an association between the layer two address of the subscriber device and the layer three address assigned to the subscriber device; and admit the subscriber device on an interface of the network device based on the assignment of the layer three address; and wherein the network device does not store an association for the subscriber device when the subscriber device has not been assigned the layer three address by the layer 3 address server such that the network device does not learn the layer two address in the data unit until a layer three address has been assigned to the subscriber device.
20. The non-transitory computer-readable storage of claim 19 , wherein the subscriber device is a first subscriber device, wherein the interface is a first interface, and wherein the association between the layer two address of the first subscriber device and the layer three address assigned to the first subscriber device are mapped in a table, the medium further comprising instructions to cause the processor to:
store, for each of a plurality of subscriber lines, an association between a plurality of layer two addresses and a plurality of layer three addresses in the table; and
compare a layer two address and a layer three address of a second subscriber device attempting to connect to the network device with the plurality of layer two addresses and the plurality of layer three addresses in the table;
if the first subscriber device and the second subscriber device share the same layer two address but have different layer three addresses, then deny admittance to the second subscriber device based on the comparison; and
if the first subscriber device and the second subscriber device share the same layer two address and share the same layer three address, then admit the second subscriber device on a second interface based on the comparison.
21. The non-transitory computer-readable storage of claim 20 , wherein the instructions to cause the processor to admit the second subscriber device further comprises instructions to cause the processor to:
remove the layer two address and the layer three address of the first subscriber device from the table; and
add the layer two address and the layer three address of the second subscriber device and the second interface to the table.
22. The non-transitory computer-readable storage of claim 21 , further comprising instructions to cause the processor to:
inform an operator if the first subscriber device and the second subscriber device share the same layer two address but have different layer three addresses; and
drop a Dynamic Host Configuration Protocol (DHCP) offer to the second subscriber device.
23. The non-transitory computer-readable storage of claim 19 , further comprising instructions to cause the processor to:
probe the network to determine whether a layer three address is in use before admitting the subscriber device on the interface of the network device.
24. The non-transitory computer-readable storage of claim 23 , wherein the instructions to cause the processor to probe the network comprise instructions to cause the processor to:
transmit a data unit using a ping utility to the layer three address; and
determine whether a reply data unit is received from the layer three address in response to the ping utility.
25. The non-transitory computer-readable storage of claim 19 , wherein the network device is a first network device, the medium further comprising instructions to cause the processor to:
protect a table in a second network device by configuring the first network device as a layer three relay agent.
26. The non-transitory computer-readable storage of claim 19 , wherein the network device is a first network device, the medium further comprising instructions to cause the processor to:
protect a table in a second network device by configuring the first network device to act as a layer two relay agent; and
provide a dedicated Virtual Local Area Network (VLAN) for transmitting Dynamic Host Configuration Protocol (DHCP) data unit traffic, wherein the VLAN comprises the first network device, the second network device, and a third network device, and wherein the third network device is in electrical communication with a DHCP server.
27. The non-transitory computer-readable storage of claim 26 , wherein the first network device is an access node, the second network device includes a layer two switch, and the third network device includes a layer three router.
28. The non-transitory computer-readable storage of claim 27 , wherein the access node is part of an access network.
29. A network device comprising:
means for receiving a data unit at a network device, the data unit including a layer two address for a subscriber device; and means for determining when the subscriber device has been assigned a layer three address by a layer 3 address server;
when the subscriber device has been assigned the layer three address by the layer 3 address server, then: means for storing, in a memory device, an association between the layer two address of the subscriber device and the layer three address assigned to the subscriber device; and means for admitting the subscriber device on an interface of the network device based on the assignment of the layer three address; and
wherein the network device does not store an association for the subscriber device when the subscriber device has not been assigned the layer three address by the layer 3 address server such that the network device does not learn on the data unit until a layer three address has been assigned to the subscriber device.
30. The network device of claim 29 , wherein the subscriber device is a first subscriber device, wherein the interface is a first interface, and wherein the association between layer two address of the first subscriber device and the layer three address assigned to the first subscriber device is stored in a table, the network device further comprising:
means for storing, for each of a plurality of subscriber lines, an association between a plurality of layer two addresses and a plurality of layer three addresses in the table;
means for comparing a layer two address and a layer three address of a second subscriber device attempting to connect to the network device with the plurality of layer two addresses and the plurality of layer three addresses in the table;
if the first subscriber device and the second subscriber device share the same layer two address but have different layer three addresses, then means for denying admittance to the second subscriber device based on the comparison; and
if the first subscriber device and the second subscriber device share the same layer two address and share the same layer three address, then means for admitting the second subscriber device on a second interface based on the comparison.
31. The network device of claim 30 , wherein the means for admitting the second subscriber device further comprises:
means for removing the layer two address and the layer three address of the first subscriber device from the table; and
means for adding the layer two address and the layer three address of the second subscriber device and the second interface to the table.
32. The network device of claim 29 , wherein the network device is a first network device, the network device further comprising:
means for protecting a table in a second network device by configuring the first network device as a layer three relay agent.
33. The network device of claim 29 , wherein the network device is a first network device, the network device further comprising:
means for protecting a table in a second network device by configuring the first network device to act as a layer two relay agent; and
means for providing a dedicated Virtual Local Area Network (VLAN) for transmitting Dynamic Host Configuration Protocol (DHCP) data unit traffic, wherein the VLAN comprises the first network device, the second network device, and a third network device, and wherein the third network device is in communication with a DHCP server.
34. The network device of claim 33 , wherein the first network device is an access node, the second network device includes a layer two switch, and the third network device includes a layer three router.
35. The network device of claim 34 , wherein the access node is part of an access network.