Method and Apparatus for Preventing Spoofed Packet Attacks

1 . A method for preventing spoofed packet attacks in a network including a DHCP relay agent device, a plurality of client devices, and a DHCP server, the method comprising:

the DHCP relay agent device forwarding address assignment packets between the clients and the DHCP server;

the DHCP relay agent device establishing and maintaining a client information table comprising client information obtained from the address assignment packets; and

the DHCP relay agent device filtering neighbour discovery (ND) packets sent from the clients in accordance with a current state of the client information table.

2 . The method of claim 1 , wherein:

the address assignment packets comprise at least one selected from the group consisting of: request, renew, rebind, reply, release and decline messages;

each entry in the client information table is associated with a particular one of the clients and comprises: an IP address, a client ID, an access point identifier, a lease time, and an entry state, where the entry state reflects one of temporary, running, or updating;

the DHCP relay agent device establishing and maintaining the client information table comprises:

responsive to receiving a request message from a particular client device, looking in the client information table for a corresponding entry with a same client ID as the message, and if no corresponding entry is found, creating a new entry containing the client ID and the receiving access point and setting the new entry's state to temporary.

3 . The method of claim 2 , wherein the DHCP relay agent device establishing and maintaining the client information table further comprises:

determining an amount of time that the new entry has retained a state of temporary;

responsive to determining that the amount of time is greater than a predetermined threshold amount of time, removing the new entry from the client information table.

4 . The method of claim 2 , wherein the DHCP relay agent device establishing and maintaining the client information table further comprises:

responsive to receiving from the DHCP server a reply message in response to the request message, the DHCP relay agent looking in the client information table for a corresponding entry that has the same client ID as the reply message and has its state set as temporary, and responsive to finding the corresponding entry, changing the corresponding entry's state to running and adding the client IP address and lease information included in the reply message to the corresponding entry.

5 . The method of claim 4 , wherein the DHCP relay agent device establishing and maintaining the client information table further comprises:

determining, from the lease information included in the corresponding entry, that the particular client device's lease has expired; and

responsive to determining that the particular client device's lease has expired, removing the corresponding entry from the client information table.

6 . The method of claim 4 , wherein the DHCP relay agent device establishing and maintaining the client information table further comprises:

responsive to receiving a renew or rebind message from the client, the DHCP relay agent looking in the client information table for a corresponding entry that has the same client IP address and client ID as the message and is in a running state, and responsive to finding the corresponding entry, changing the corresponding entry's state to updating.

7 . The method of claim 6 , wherein the DHCP relay agent device establishing and maintaining the client information table further comprises:

responsive to receiving a reply message in response to the renew or rebind message from the DHCP server, the DHCP relay agent looking in the client information table for a corresponding entry that has the same client ID and client IP address as the reply message and is in the updating state, and responsive to finding the corresponding entry, changing the corresponding entry's state to running and updating the lease in the entry according to the reply message.

8 . The method of claim 4 , wherein the DHCP relay agent device establishing and maintaining the client information table further comprises:

responsive to receiving a release or decline message from the client, the DHCP relay agent looking in the client information table for a corresponding entry with the same client IP address and client ID as the message, and responsive to finding the corresponding entry, removing the corresponding entry.

9 . The method of claim 2 , wherein the address assignment packets further comprise: a solicit message carrying a rapid commit option and reply message carrying a rapid commit option in response to the solicit message; and

wherein the method further comprises:

responsive to receiving a solicit message carrying a rapid commit option and a client ID from a particular client device, the DHCP relay agent looking in the client information table for a corresponding entry with the same client ID and, responsive to finding no corresponding entry, the DHCP relay agent creating a new entry containing the client ID and the receiving access point and setting its state as temporary.

10 . The method of claim 9 , wherein the method further comprises:

responsive to receiving a reply message carrying a rapid commit option and client ID from the DHCP server, the DHCP relay agent looking in the client information table for a corresponding entry, and responsive to finding the corresponding entry with the same client ID and a state of temporary, the DHCP relay agent changing the corresponding entry's state to running and adding the client IP address and lease information in the reply message to the corresponding entry.

11 . The method of claim 2 , wherein the client ID comprises a client link address and a transaction ID.

12 . The method of claim 2 , wherein the DHCP relay agent filtering ND packets from a second particular client according to the client information table comprises:

responsive to receiving an ND packet from the second particular client, the DHCP relay agent looking in the client information table for a matching entry according to the source IP address and client ID in the ND packet and according to the receiving access point;

the DHCP relay agent dropping the ND packet if (i) a matching entry is not found or (ii) a matching entry is found but its state is set to temporary, and otherwise, the DHCP relay agent processing the ND packet normally.

13 . A DHCP relay agent device comprising a forwarding module, a storage module, and a filtering module, wherein:

the forwarding module is configured to forward address assignment packets between client devices and a DHCP server, and to establish and maintain a client information table comprising client information obtained from the address assignment packets;

the storage module is configured to store the client information table; and

the filtering module is configured to filter neighbour discovery (ND) packets sent from the client devices in accordance with a current state of the client information table.

14 . The DHCP relay agent device of claim 13 , wherein the address assignment packets forwarded by the forwarding module comprise at least one selected from the group consisting of: request, renew, rebind, reply, release and decline messages;

wherein each entry in the client information table is associated with a particular one of the clients and comprises: a client IP address, a client ID, an access point identifier, a lease time, and an entry state, where the entry state reflects one of temporary, running, or updating; and

wherein the forwarding module is configured to, responsive to receiving a request message carrying a client ID from a particular client device, look in the client information table for a corresponding entry with the same client ID, and if no corresponding entry is found, create a new entry containing the client ID and the receiving access point and setting the new entry's state to temporary.

15 . The DHCP relay agent device of claim 14 , wherein the forwarding module is further configured to, responsive to receiving from the DHCP server a reply message in response to the request message, look in the client information table for a corresponding entry that has the same client ID as the reply message and has a state of temporary, and responsive to finding the corresponding entry, changing the corresponding entry's state to running and adding the client IP address and lease information in the reply message to the corresponding entry.

16 . The DHCP relay agent device of claim 15 , wherein the forwarding module is further configured to, responsive to receiving a renew or rebind message from the particular client device, look in the client information table for a corresponding entry that has the same client IP address and client ID as the message and has a state of running, and responsive to finding the corresponding entry, change the corresponding entry's state to updating.

17 . The DHCP relay agent device of claim 16 , wherein the forwarding module is further configured to, responsive to receiving a reply message in response to the renew or rebind message from the DHCP server, look in the client information table for a corresponding entry that has the same client ID and client IP address as the reply message and has a state of updating, and responsive to finding the corresponding entry, change the corresponding entry's state to running and update the lease in the corresponding entry according to that set forth in the reply message.

18 . The DHCP relay agent device of claim 15 , wherein the forwarding module is further configured to, responsive to receiving a release or decline message from the particular client device, look in the client information table for a corresponding entry with the same client IP address and client ID as the message, and responsive to finding the corresponding entry, remove the entry.

19 . The DHCP relay agent device of claim 14 , wherein the forwarding module is further configured to:

responsive to receiving a solicit message carrying a rapid commit option and a client ID from the particular client device, look in the client information table for a corresponding entry with the same client ID, and responsive to finding no corresponding entry, create a new entry containing the client ID and the receiving access point and set the new entry's state to temporary; and

responsive to receiving a reply message carrying a rapid commit option and client ID from the DHCP server, look in the client information table for a corresponding entry, and responsive to finding a corresponding entry with the same client ID and a state of temporary, the change the corresponding entry's state to running and add the client IP address and lease information in the reply message to the corresponding entry.

20 . The DHCP relay agent device of claim 14 , wherein the filtering module is configured to, responsive to receiving a ND packet from a second particular client device, look up the client information table for a match according to the source IP address and client ID in the ND packet and the receiving access point, and

wherein the filtering module is further configured to drop the ND packet if (i) a matching entry is not found or (ii) a matching entry is found but its state is set to temporary, and otherwise, the filtering module processes the ND packet normally.