Secure DHCP processing for layer two access networks
View Patent ↗In general, this disclosure describes network security techniques that may accommodate legitimate movement of a subscriber device while preventing MAC collisions that may result from configuration errors or MAC spoofing attempts. MAC spoofing may result in packets directed to one subscriber device being sent instead to another subscriber device. By modifying an access node or a Dynamic Host Configuration Protocol (DHCP) server to allow only authorized subscriber devices on the access network, layer two collisions (“MAC collisions”) may be prevented.
1. A method comprising:
receiving a layer two domain identifier of a layer two domain in which a first subscriber device resides;
storing an association between the layer two domain identifier of the first subscriber device and a layer two address of the first subscriber device;
comparing a layer two domain identifier and a layer two address of a second subscriber device attempting to acquire a layer three address with the layer two domain identifier and the layer two address of the first subscriber device;
denying a layer three address to the second subscriber device based on the comparison if the first subscriber device and the second subscriber device share the same layer two address and share the same layer two domain identifier; and
offering the second subscriber device a layer three address based on the comparison if the first subscriber device and the second subscriber device share the same layer two address but have different layer two domain identifiers.
2. The method of claim 1 , wherein storing an association between the layer two domain identifier of the first subscriber device and a layer two address of the first subscriber device further comprises:
storing, for each of a plurality of subscriber lines, an association between a plurality of layer two domain identifiers and a plurality of layer two addresses in a table.
3. The method of claim 1 , wherein the layer two domain identifier is received as a Dynamic Host Configuration Protocol (DHCP) option in a DHCP message relayed from the subscriber device.
4. The method of claim 1 , wherein the layer two domain identifier comprises at least one virtual local area network (VLAN) identifier associated with the subscriber device.
5. The method of claim 1 , further comprising:
probing the network to determine whether a layer three address is in use before offering the layer three address to the subscriber device.
6. The method of claim 5 , wherein probing the network comprises:
transmitting a data unit using a ping utility to the layer three address; and
determining whether a reply data unit is received from the layer three address in response to the ping utility.
7. The method of claim 1 , wherein the network device is a first network device, the method further comprising:
protecting a table in a second network device by configuring a third network device to act as a layer two relay agent; and
providing a dedicated Virtual Local Area Network (VLAN) for transmitting Dynamic Host Configuration Protocol (DHCP) data unit traffic, wherein the VLAN comprises the second network device, the third network device, and a fourth network device, and wherein the fourth network device is in communication with the first network device.
8. The method of claim 7 , wherein the first network device is a DHCP server, the second network device includes a layer two switch, the third network device includes an access node, and the fourth network device includes a layer three router.
9. A network device comprising a processor configured to:
receive a layer two domain identifier of a layer two domain in which a first subscriber device resides;
store an association between the layer two domain identifier of the first subscriber device and a layer two address of the first subscriber device;
compare a layer two domain identifier and a layer two address of a second subscriber device attempting to acquire a layer three address with the layer two domain identifier and the layer two address of the first subscriber device;
deny a layer three address to the second subscriber device based on the comparison if the first subscriber device and the second subscriber device share the same layer two address and share the same layer two domain identifier; and
offer the second subscriber device a layer three address based on the comparison if the first subscriber device and the second subscriber device share the same layer two address but have different layer two domain identifiers.
10. The network device of claim 9 , wherein the layer two domain identifier is received as a Dynamic Host Configuration Protocol (DHCP) option in a DHCP message relayed from the subscriber device.
11. The network device of claim 9 , wherein the layer two domain identifier comprises at least one virtual local area network (VLAN) identifier associated with the subscriber device.
12. The network device of claim 9 , wherein the processor configured to store an association between the layer two domain identifier of the first subscriber device and a layer two address of the first subscriber device is further configured to:
store, for each of a plurality of subscriber lines, an association between a plurality of layer two domain identifiers and a plurality of layer two addresses in a table.
13. The network device of claim 9 , wherein the processor is further configured to:
probe the network to determine whether a layer three address is in use before offering the layer three address to the first subscriber device.
14. The network device of claim 13 , wherein the processor configured to probe the network is configured to:
transmit a data unit using a ping utility to the layer three address; and
determine whether a reply data unit is received from the layer three address in response to the ping utility.
15. The network device of claim 9 , wherein the network device is a first network device, and wherein the processor is further configured to:
protect a table in a second network device by configuring a third network device to act as a layer two relay agent; and
provide a dedicated Virtual Local Area Network (VLAN) for transmitting Dynamic Host Configuration Protocol (DHCP) data unit traffic, wherein the VLAN comprises the second network device, the third network device, and a fourth network device, and wherein the fourth network device is in communication with the first network device.
16. The network device of claim 15 , wherein the first network device is a DHCP server, the second network device is a layer two switch, the third network device is an access node, and the fourth network device is a layer three router.
17. A non-transitory computer-readable medium comprising instructions encoded on the computer-readable medium that, upon execution, cause a processor within a network device to:
receive a layer two domain identifier of a layer two domain in which a first subscriber device resides;
store an association between the layer two domain identifier of the first subscriber device and a layer two address of the first subscriber device;
compare a layer two domain identifier and a layer two address of a second subscriber device attempting to acquire a layer three address with the layer two domain identifier and the layer two address of the first subscriber device;
deny a layer three address to the second subscriber device based on the comparison if the first subscriber device and the second subscriber device share the same layer two address and share the same layer two domain identifier; and
offer the second subscriber device a layer three address based on the comparison if the first subscriber device and the second subscriber device share the same layer two address but have different layer two domain identifiers.
18. The non-transitory computer-readable medium of claim 17 , wherein the layer two domain identifier is received as a Dynamic Host Configuration Protocol (DHCP) option in a DHCP message relayed from the subscriber device.
19. The non-transitory computer-readable medium of claim 17 , wherein the layer two domain identifier comprises at least one virtual local area network (VLAN) identifier associated with the subscriber device.
20. The non-transitory computer-readable medium of claim 17 , wherein the subscriber device is a first subscriber device, further comprising instructions to cause the processor to:
store, for each of a plurality of subscriber lines, an association between a plurality of layer two domain identifiers and a plurality of layer two addresses in a table.
21. The non-transitory computer-readable medium of claim 17 , further comprising instructions to cause the processor to:
probe the network to determine whether a layer three address is in use before offering the layer three address to the subscriber device.
22. The non-transitory computer-readable medium of claim 21 , wherein the instructions that cause the processor to probe the network comprise instructions to cause the processor to:
transmit a data unit using a ping utility to the layer three address; and
determine whether a reply data unit is received from the layer three address in response to the ping utility.
23. The non-transitory computer-readable medium of claim 17 , wherein the network device is a first network device, further comprising instructions to cause the processor to:
protect a table in a second network device by configuring a third network device to act as a layer two relay agent; and
provide a dedicated Virtual Local Area Network (VLAN) for transmitting Dynamic Host Configuration Protocol (DHCP) data unit traffic, wherein the VLAN comprises the second network device, the third network device, and a fourth network device, and wherein the fourth network device is in communication with the fourth network device.
24. The non-transitory computer-readable medium of claim 23 , wherein the first network device is a DHCP server, the second network device includes a layer two switch, the third network device includes an access node, and the fourth network device includes a layer three router.
25. A network device comprising:
means for receiving a layer two domain identifier of a layer two domain in which a first subscriber device resides;
means for storing an association between the layer two domain identifier of the first subscriber device and a layer two address of the first subscriber device;
means for comparing a layer two domain identifier and a layer two address of a second subscriber device attempting to acquire a layer three address with the layer two domain identifier and the layer two address of the first subscriber device;
means for denying a layer three address to the second subscriber device based on the comparison if the first subscriber device and the second subscriber device share the same layer two address and share the same layer two domain identifier; and
means for offering the second subscriber device a layer three address based on the comparison if the first subscriber device and the second subscriber device share the same layer two address but have different layer two domain identifiers.
26. The network device of claim 25 , wherein the means for storing an association between the layer two domain identifier of the first subscriber device and a layer two address of the first subscriber device further comprises:
means for storing, for each of a plurality of subscriber lines, an association between a plurality of layer two domain identifiers and a plurality of layer two addresses in a table.
27. The network device of claim 25 , wherein the layer two domain identifier is received as a Dynamic Host Configuration Protocol (DHCP) option in a DHCP message relayed from the subscriber device.
28. The network device of claim 25 , wherein the layer two domain identifier comprises at least one virtual local area network (VLAN) identifier associated with the subscriber device.
29. The network device of claim 25 , further comprising:
means for probing the network to determine whether a layer three address is in use before offering the layer three address to the subscriber device.
30. The network device of claim 29 , wherein probing the network comprises:
means for transmitting a data unit using a ping utility to the layer three address; and
means for determining whether a reply data unit is received from the layer three address in response to the ping utility.
31. The network device of claim 25 , wherein the network device is a first network device, the method further comprising:
means for protecting a table in a second network device by configuring a third network device to act as a layer two relay agent; and
means for providing a dedicated Virtual Local Area Network (VLAN) for transmitting Dynamic Host Configuration Protocol (DHCP) data unit traffic, wherein the VLAN comprises the second network device, the third network device, and a fourth network device, and wherein the fourth network device is in communication with the first network device.
32. The network device of claim 31 , wherein the first network device is a DHCP server, the second network device includes a layer two switch, the third network device includes an access node, and the fourth network device includes a layer three router.