Device spoofing detection using MAC authentication bypass endpoint database access control

1. An information security system, comprising:

a switch comprising a plurality of ports configured to provide network connectivity for one or more endpoint devices to a network; and

a device operably coupled to the switch, comprising:

a memory operable to store a device information table comprising:

MAC addresses of previously authenticated endpoint devices; and

device types linked with the MAC addresses of previously authenticated endpoint devices; and

an access control engine implemented by a processor, configured to:

receive device information for an endpoint device connected to a port of the switch, comprising:

a MAC address for the endpoint device; and

a device type for the endpoint device;

compare the MAC address for the endpoint device to MAC addresses in the device information table;

identify a MAC address in the device information table that matches the MAC address for the endpoint device;

identify a device type for the identified MAC address in the device information table;

compare the device type for the endpoint device to the device type for the identified MAC address in the device information table;

determine that the device type for the endpoint device does not match the device type for the identified MAC address in the device information table; and

set a port status for the port to blocked in response to determining that the device type for the endpoint device does not match the device type for the identified MAC address in the device information table.

2. The system of claim 1 , wherein:

the device information table comprises exemption information linked with the MAC addresses of previously authenticated endpoint devices; and

the access control engine is further configured to:

identify exemption information for the identified MAC address in the device information table;

determine the identified MAC address in the device information table is not associated with a duplicate exemption;

determine another instance of the MAC address for the endpoint device is connected to the network; and

set a port status for the port to blocked in response to determining that another instance of the MAC address for the endpoint device is connected to the network.

3. The system of claim 1 , wherein:

the access control engine is further configured to send a blackhole command to the switch in response to setting the port status to blocked; and

the switch is configured to transform the destination of traffic associated with the endpoint device to a null destination in response to receiving the blackhole command.

4. The system of claim 1 , wherein:

the access control engine is further configured to send a blackhole command to the switch in response to setting the port status to blocked; and

the switch is configured to discard traffic associated with the endpoint device in response to receiving the blackhole command.

5. The system of claim 1 , wherein:

the access control engine is further configured to send a disable command to the switch in response to setting the port status to blocked; and

the switch is configured to disable the port the endpoint device is connected to in response to receiving the disable command.

6. The system of claim 1 , wherein:

the access control engine is further configured to send a disable command to the switch in response to setting the port status to blocked; and

the switch is configured to disconnect electrical power to the port the endpoint device is connected to in response to receiving the disable command.

7. The system of claim 1 , wherein the access control engine is further configured to send a spoofing alert in response to setting the port status to blocked.

8. An information security device, comprising:

a memory operable to store a device information table comprising:

MAC addresses of previously authenticated endpoint devices; and

device types linked with the MAC addresses of previously authenticated endpoint devices; and

an access control engine implemented by a processor, configured to:

receive device information for an endpoint device connected to a port of a switch, comprising:

a MAC address for the endpoint device; and

a device type for the endpoint device;

compare the MAC address for the endpoint device to MAC addresses in the device information table;

identify a MAC address in the device information table that matches the MAC address for the endpoint device;

identify a device type for the identified MAC address in the device information table;

compare the device type for the endpoint device to the device type for the identified MAC address in the device information table;

determine that the device type for the endpoint device does not match the device type for the identified MAC address in the device information table; and

set a port status for the port to blocked in response to determining that the device type for the endpoint device does not match the device type for the identified MAC address in the device information table.

9. The device of claim 8 , wherein:

the device information table comprises exemption information linked with the MAC addresses of previously authenticated endpoint devices; and

the access control engine is further configured to:

identify exemption information for the identified MAC address in the device information table;

determine the identified MAC address in the device information table is not associated with a duplicate exemption;

determine another instance of the MAC address for the endpoint device is connected to the network; and

set a port status for the port to blocked in response to determining that another instance of the MAC address for the endpoint device is connected to the network.

10. The device of claim 8 , wherein:

the access control engine is further configured to send a blackhole command to the switch in response to setting the port status to blocked; and

the blackhole command triggers the switch to transform the destination of traffic associated with the endpoint device to a null destination.

11. The device of claim 8 , wherein:

the access control engine is further configured to send a blackhole command to the switch in response to setting the port status to blocked; and

the blackhole command triggers the switch to discard traffic associated with the endpoint device.

12. The device of claim 8 , wherein:

the access control engine is further configured to send a disable command to the switch in response to setting the port status to blocked; and

the blackhole command triggers the switch to disable the port the endpoint device is connected to.

13. The device of claim 8 , wherein:

the access control engine is further configured to send a disable command to the switch in response to setting the port status to blocked; and

the blackhole command triggers the switch to disconnect electrical power to the port the endpoint device is connected to.

14. The device of claim 8 , wherein the access control engine is further configured to send a spoofing alert in response to setting the port status to blocked.

15. An information security method, comprising:

receiving, at an access control engine implemented by a processor, device information for an endpoint device connected to a port of the switch, comprising:

a MAC address for the endpoint device; and

a device type for the endpoint device;

comparing, by the access control engine, the MAC address for the endpoint device to MAC addresses in a device information table, wherein the device table comprises:

MAC addresses of previously authenticated endpoint devices; and

device types linked with the MAC addresses of previously authenticated endpoint devices;

identifying, by the access control engine, a MAC address in the device information table that matches the MAC address for the endpoint device;

identifying, by the access control engine, a device type for the identified MAC address in the device information table;

comparing, by the access control engine, the device type for the endpoint device to the device type for the identified MAC address in the device information table;

determining, by the access control engine, that the device type for the endpoint device does not match the device type for the identified MAC address in the device information table; and

setting, by the access control engine, a port status for the port to blocked in response to determining that the device type for the endpoint device does not match the device type for the identified MAC address in the device information table.

16. The method of claim 15 , further comprising:

sending, by the access control engine, a blackhole command to the switch in response to setting the port status to blocked; and

transforming, by the switch, the destination of traffic associated with the endpoint device to a null destination in response to receiving the blackhole command.

17. The method of claim 15 , further comprising:

sending, by the access control engine, a blackhole command to the switch in response to setting the port status to blocked; and

discarding, by the switch, traffic associated with the endpoint device in response to receiving the blackhole command.

18. The method of claim 15 , further comprising:

sending, by the access control engine, a disable command to the switch in response to setting the port status to blocked; and

disabling, by the switch, the port the endpoint device is connected to in response to receiving the disable command.

19. The method of claim 15 , further comprising:

sending, by the access control engine, a disable command to the switch in response to setting the port status to blocked; and

disconnecting, by the switch, electrical power to the port the endpoint device is connected to in response to receiving the disable command.

20. The method of claim 15 , wherein further comprising sending, by the access control engine, a spoofing alert in response to setting the port status to blocked.