Method for securing a DHCP server from unauthorized client attacks in a software defined network

1. A method for a hypervisor to secure a dynamic host configuration protocol (DHCP) server against unauthorized client attacks in a software defined networking environment, the method comprising:

determining a count of sub-interfaces implemented on an interface card of a virtual machine;

setting a count of unique client identifiers for the virtual machine to zero;

determining whether a dynamic host configuration protocol (DHCP) request has been received from the virtual machine;

in response to determining that a DHCP request has been received from the virtual machine:

determining a current count of the unique client identifiers by incrementing the count of the unique client identifiers based on a number of client identifiers included in the DHCP request;

determining whether the current count of the unique client identifiers exceeds the count of the sub-interfaces implemented on the interface card of the virtual machine; and

in response to determining that the current count of the unique client identifiers does not exceed the count of the sub-interfaces implemented on the interface card of the virtual machine, forwarding the DHCP request to an uplink port.

2. The method of claim 1 , further comprising:

in response to determining that the current count of unique client identifiers does not exceed the current count of sub-interfaces implemented on the interface card of the virtual machine:

parsing the DHCP request to identify a particular client identifier included in the DHCP request;

determining whether the particular client identifier is mapped on a particular unique client identifier from a set of unique client identifiers received from a management plane or a control plane;

in response to determining that the particular client identifier is mapped on the particular unique client identifier from the set of unique client identifiers:

retrieving the particular unique client identifier from the set of unique client identifiers;

replacing the particular client identifier in the DHCP request with the particular unique client identifier; and

forwarding the DHCP request to an uplink port.

3. The method of claim 2 , further comprising:

transmitting, to the management plane, the count of sub-interfaces implemented on the interface card of the virtual machine;

in response to transmitting the count of sub-interfaces to the management plane, receiving, from the management plane, the set of unique client identifiers that includes a particular count of unique client identifiers; and

wherein the particular count of unique client identifiers corresponds to the count of sub-interfaces implemented on the interface card of the virtual machine.

4. The method of claim 1 , further comprising:

in response to determining that the current count of unique client identifiers does not exceed the count of sub-interfaces implemented on the interface card of the virtual machine, transmitting the DHCP request to a DHCP server.

5. The method of claim 1 , further comprising:

in response to determining that the current count of unique client identifiers exceeds the count of sub-interfaces implemented on the interface card of the virtual machine, generating a warning indicating that the DHCP request might have been received from a rogue virtual machine.

6. The method of claim 1 , further comprising:

determining whether a DHCP address release request has been received from the virtual machine; and

in response to determining that a DHCP address release request has been received from the virtual machine, decrementing the current count of unique client identifiers.

7. The method of claim 1 , wherein the count of sub-interfaces implemented on the interface card of the virtual machine is provided by one or more of: a management plane, a control plane, or the virtual machine.

8. One or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by one or more processors, cause the one or more processors to perform:

determining a count of sub-interfaces implemented on an interface card of a virtual machine;

setting a count of unique client identifiers for the virtual machine to zero;

determining whether a dynamic host configuration protocol (DHCP) request has been received from the virtual machine;

in response to determining that a DHCP request has been received from the virtual machine:

determining a current count of the unique client identifiers by incrementing the count of the unique client identifiers based on a number of client identifiers included in the DHCP request;

determining whether the current count of the unique client identifiers exceeds the count of the sub-interfaces implemented on the interface card of the virtual machine; and

in response to determining that the current count of the unique client identifiers does not exceed the count of the sub-interfaces implemented on the interface card of the virtual machine, forwarding the DHCP request to an uplink port.

9. The one or more non-transitory computer-readable storage media of claim 8 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to perform:

in response to determining that the current count of unique client identifiers does not exceed the count of sub-interfaces implemented on the interface card of the virtual machine:

parsing the DHCP request to identify a particular client identifier included in the DHCP request;

determining whether the particular client identifier is mapped on a particular unique client identifier from a set of unique client identifiers received from a management plane or a control plane;

in response to determining that the particular client identifier is mapped on the particular unique client identifier from the set of unique client identifiers:

retrieving the particular unique client identifier from the set of unique client identifiers;

replacing the particular client identifier in the DHCP request with the particular unique client identifier; and

forwarding the DHCP request to an uplink port.

10. The one or more non-transitory computer-readable storage media of claim 9 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to perform:

transmitting, to the management plane, the count of sub-interfaces implemented on the interface card of the virtual machine;

in response to transmitting the count of sub-interfaces to the management plane, receiving, from the management plane, the set of unique client identifiers that includes a particular count of unique client identifiers; and

wherein the particular count of unique client identifiers corresponds to the count of sub-interfaces implemented on the interface card of the virtual machine.

11. The one or more non-transitory computer-readable storage media of claim 8 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to perform:

in response to determining that the current count of unique client identifiers does not exceed the count of sub-interfaces implemented on the interface card of the virtual machine, transmitting the DHCP request to a DHCP server.

12. The one or more non-transitory computer-readable storage media of claim 8 , further comprising:

in response to determining that the current count of unique client identifiers exceeds the count of sub-interfaces implemented on the interface card of the virtual machine, generating a warning indicating that the DHCP request might have been received from a rogue virtual machine.

13. The one or more non-transitory computer-readable storage media of claim 8 , further comprising:

determining whether a DHCP address release request has been received from the virtual machine; and in response to determining that a DHCP address release request has been received from the virtual machine, decrementing the current count of unique client identifiers.

14. The one or more non-transitory computer-readable storage media of claim 8 , wherein the count of sub-interfaces implemented on the interface card of the virtual machine is provided by one or more of: a management plane, a control plane, or the virtual machine.

15. A hypervisor implemented in a host computer and configured to secure a dynamic host configuration protocol (DHCP) server against unauthorized client attacks in a software defined networking environment, the hypervisor comprising:

one or more processors;

one or more memory units; and

one or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by the one or more processors, cause the one or more processors to perform:

determining a count of sub-interfaces implemented on an interface card of a virtual machine;

setting a count of unique client identifiers for the virtual machine to zero;

determining whether a dynamic host configuration protocol (DHCP) request has been received from the virtual machine;

in response to determining that a DHCP request has been received from the virtual machine:

determining a current count of the unique client identifiers by incrementing the count of the unique client identifiers based on a number of client identifiers included in the DHCP request

determining whether the current count of the unique client identifiers exceeds the count of the sub-interfaces implemented on the interface card of the virtual machine; and

in response to determining that the current count of the unique client identifiers does not exceed the count of the sub-interfaces implemented on the interface card of the virtual machine, forwarding the DHCP request to an uplink port.

16. The hypervisor of claim 15 , wherein the one or more non-transitory computer-readable storage media store additional instructions which, when executed by the one or more processors, cause the one or more processors to perform:

in response to determining that the current count of unique client identifiers does not exceed the count of sub-interfaces implemented on the interface card of the virtual machine:

parsing the DHCP request to identify a particular client identifier included in the DHCP request;

determining whether the particular client identifier is mapped on a particular unique client identifier from a set of unique client identifiers received from a management plane or a control plane;

in response to determining that the particular client identifier is mapped on the particular unique client identifier from the set of unique client identifiers:

retrieving the particular unique client identifier from the set of unique client identifiers;

replacing the particular client identifier in the DHCP request with the particular unique client identifier; and

forwarding the DHCP request to an uplink port.

17. The hypervisor of claim 16 , wherein the one or more non-transitory computer-readable storage media store additional instructions which, when executed by the one or more processors, cause the one or more processors to perform:

transmitting, to the management plane, the count of sub-interfaces implemented on the interface card of the virtual machine;

in response to transmitting the count of sub-interfaces to the management plane, receiving, from the management plane, the set of unique client identifiers that includes a particular count of unique client identifiers; and

wherein the particular count of unique client identifiers corresponds to the count of sub-interfaces implemented on the interface card of the virtual machine.

18. The hypervisor of claim 15 , wherein the one or more non-transitory computer-readable storage media store additional instructions which, when executed by the one or more processors, cause the one or more processors to perform:

in response to determining that the current count of unique client identifiers does not exceed the count of sub-interfaces implemented on the interface card of the virtual machine, transmitting the DHCP request to a DHCP server.

19. The hypervisor of claim 15 , wherein the one or more non-transitory computer-readable storage media store additional instructions which, when executed by the one or more processors, cause the one or more processors to perform:

determining whether a DHCP address release request has been received from the virtual machine; and

in response to determining that a DHCP address release request has been received from the virtual machine, decrementing the current count of unique client identifiers.

20. The hypervisor of claim 15 , wherein the count of sub-interfaces implemented on the interface card of the virtual machine is provided by one or more of:

a management plane, a control plane, or the virtual machine.