Determine a trusted dynamic host configuration protocol (DHCP) server in a DHCP snooping environment
Presented herein are systems and methods to determine whether a dynamic host configuration protocol (DHCP) server in DHCP snooping environment is a trusted device without requiring trusted port configuration. In one or more embodiments, a DHCP snooping-enable switch/router adds an indicator to a message intended for a DHCP server, thereby notifying the DHCP server that the DHCP switch/router is enabled for or capable of “detection of trusted DHCP server.” The DHCP server includes a unique trusted identifier in its reply that the DHCP switch/router uses to verify whether the DHCP server can be considered a trusted device.
1. A computer-implemented method for determining a trusted dynamic host configuration protocol (DHCP) server in a DHCP snooping environment, the method comprising:
responsive to receiving at a DHCP information handling system a client message from a DHCP client:
adding an indicator to the client message to indicate to a DHCP server, that is to receive the client message with the indicator, that the DHCP information handling system performs a check to verify if the DHCP server is a trusted device; and
sending the client message with the indicator to the DHCP server; and
responsive to receiving at the DHCP information handling system a reply message from the DHCP server:
obtaining a received unique trusted identifier value from the reply message that was included by the DHCP server to verify status of the DHCP server;
obtaining a generated unique trusted identifier value, which was generated using at least a master key and a unique identifier for the DHCP server as inputs into a cryptographic-related operation;
comparing the received unique trusted identifier value to the generated unique trusted identifier value; and
responsive to the received unique trusted identifier value matching the generated unique trusted identifier value, sending at least a portion of the reply message to the DHCP client.
2. The computer-implemented method of claim 1 further comprising:
responsive to the received unique trusted identifier value not matching the generated unique trusted identifier value, taking one or more of the following actions comprising:
deeming the DHCP server as an untrusted device;
dropping the reply message received from the DHCP server;
adding the DHCP server to a blacklist;
creating an Access Control List (ACL) related to the DHCP server to block traffic intended for the DHCP server, originating from the DHCP server, or both;
triggering an alarm regarding the DHCP server; and
notifying a system administrator.
3. The computer-implemented method of claim 1 wherein the cryptographic-related operation is a hash function and wherein the step of obtaining a generated unique trusted identifier value, which was generated using at least a master key and a unique identifier for the DHCP server as inputs into a cryptographic-related operation comprises:
generating the generated unique trusted identifier value using a hash function and at least the master key and the unique identifier for the DHCP server as inputs to the hash function.
4. The computer-implemented method of claim 3 wherein the DHCP server generated the received unique value that it included in the reply message using the hash function and at least the master key and the unique identifier for the DHCP server as inputs to the hash function and the DHCP server and the DHCP information handling system were provisioned with the same hash function and the same master key.
5. The computer-implemented method of claim 4 wherein the unique identifier for the DHCP server is its Internet Protocol (IP) address.
6. The computer-implemented method of claim 1 further comprising:
repeating the steps of claim 1 for that DHCP server in response to one or more conditions comprising:
a verification schedule;
as a result of a change in a network comprising the DHCP information handling system;
reboot of the DHCP information handling system;
update of the DHCP information handling system;
with each communication intended for the DHCP server; and
with a subset of communications intended for the DHCP server.
7. The computer-implemented method of claim 1 wherein the received unique trusted identifier value is included in an options field of the reply message.
8. A non-transitory computer-readable medium or media comprising one or more sequences of instructions which, when executed by at least one processor, causes steps to be performed comprising:
responsive to receiving at a dynamic host configuration protocol (DHCP) information handling system a client message from a DHCP client:
adding an indicator to the client message to indicate to a DHCP server, that is to receive the client message with the indicator, that the DHCP information handling system performs a check to verify if the DHCP server is a trusted device; and
sending the client message with the indicator to the DHCP server; and
responsive to receiving at the DHCP information handling system a reply message from the DHCP server:
obtaining a received unique trusted identifier value from the reply message that was included by the DHCP server to verify status of the DHCP server;
obtaining a generated unique trusted identifier value, which was generated using at least a master key and a unique identifier for the DHCP server as inputs into a cryptographic-related operation;
comparing the received unique trusted identifier value to the generated unique trusted identifier value; and
responsive to the received unique trusted identifier value matching the generated unique trusted identifier value, sending at least a portion of the reply message to the DHCP client.
9. The non-transitory computer-readable medium or media of claim 8 further comprising one or more sequences of instructions which, when executed by at least one processor, causes steps to be performed comprising:
responsive to the received unique trusted identifier value not matching the generated unique trusted identifier value, taking one or more of the following actions comprising:
deeming the DHCP server as an untrusted device;
dropping the reply message received from the DHCP server;
adding the DHCP server to a blacklist;
creating an Access Control List (ACL) related to the DHCP server to block traffic intended for the DHCP server, originating from the DHCP server, or both;
triggering an alarm regarding the DHCP server; and
notifying a system administrator.
10. The non-transitory computer-readable medium or media of claim 8 wherein the cryptographic-related operation is a hash function and wherein the step of obtaining a generated unique trusted identifier value, which was generated using at least a master key and a unique identifier for the DHCP server as inputs into a cryptographic-related operation comprises:
generating the generated unique trusted identifier value using a hash function and at least the master key and the unique identifier for the DHCP server as inputs to the hash function.
11. The non-transitory computer-readable medium or media of claim 10 wherein the DHCP server generated the received unique value that it included in the reply message using the hash function and at least the master key and the unique identifier for the DHCP server as inputs to the hash function and the DHCP server and the DHCP information handling system were provisioned with the same hash function and the same master key.
12. The non-transitory computer-readable medium or media of claim 8 further comprising one or more sequences of instructions which, when executed by at least one processor, causes steps to be performed comprising:
repeating the steps of claim 8 for that DHCP server in response to one or more conditions comprising:
a verification schedule;
as a result of a change in a network comprising the DHCP information handling system;
reboot of the DHCP information handling system;
update of the DHCP information handling system;
with each communication intended for the DHCP server; and
with a subset of communications intended for the DHCP server.
13. The non-transitory computer-readable medium or media of claim 8 wherein the received unique trusted identifier value is included in an options field of the reply message.
14. A dynamic host configuration protocol (DHCP) information handling system comprising:
one or more processors; and
a non-transitory computer-readable medium or media comprising one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
responsive to receiving at the DHCP information handling system a client message from a DHCP client:
adding an indicator to the client message to indicate to a DHCP server that is to receive the client message with the indicator that the DHCP information handling system performs a check to verify if the DHCP server is a trusted device; and
sending the client message with the indicator to the DHCP server; and
responsive to receiving at the DHCP information handling system a reply message from the DHCP server:
obtaining a received unique trusted identifier value from the reply message that was included by the DHCP server to verify status of the DHCP server;
obtaining a generated unique trusted identifier value, which was generated using at least a master key and a unique identifier for the DHCP server as inputs into a cryptographic-related operation;
comparing the received unique trusted identifier value to the generated unique trusted identifier value; and
responsive to the received unique trusted identifier value matching the generated unique trusted identifier value, sending at least a portion of the reply message to the DHCP client.
15. The DHCP information handling system of claim 14 wherein the non-transitory computer-readable medium or media further comprises one or more sequences of instructions which, when executed by at least one processor, causes steps to be performed comprising:
responsive to the received unique trusted identifier value not matching the generated unique trusted identifier value, taking one or more of the following actions comprising:
deeming the DHCP server as an untrusted device;
dropping the reply message received from the DHCP server;
adding the DHCP server to a blacklist;
creating an Access Control List (ACL) related to the DHCP server to block traffic intended for the DHCP server, originating from the DHCP server, or both;
triggering an alarm regarding the DHCP server; and
notifying a system administrator.
16. The DHCP information handling system of claim 14 wherein the cryptographic-related operation is a hash function and wherein the step of obtaining a generated unique trusted identifier value, which was generated using at least a master key and a unique identifier for the DHCP server as inputs into a cryptographic-related operation comprises:
generating the generated unique trusted identifier value using a hash function and at least the master key and the unique identifier for the DHCP server as inputs to the hash function.
17. The DHCP information handling system of claim 16 wherein the DHCP server generated the received unique value that it included in the reply message using the hash function and at least the master key and the unique identifier for the DHCP server as inputs to the hash function and the DHCP server and the DHCP information handling system were provisioned with the same hash function and the same master key.
18. The DHCP information handling system of claim 16 wherein the unique identifier for the DHCP server is its Internet Protocol (IP) address.
19. The DHCP information handling system of claim 14 wherein the non-transitory computer-readable medium or media further comprises one or more sequences of instructions which, when executed by at least one processor, causes steps to be performed comprising:
repeating the steps of claim 14 for that DHCP server in response to one or more conditions comprising:
a verification schedule;
as a result of a change in a network comprising the DHCP information handling system;
reboot of the DHCP information handling system;
update of the DHCP information handling system;
with each communication intended for the DHCP server; and
with a subset of communications intended for the DHCP server.
20. The DHCP information handling system of claim 14 wherein the received unique trusted identifier value is included in an options field of the reply message.