Mechanism for protecting front-haul link from man-in-the-middle (MITM) attack
A method, performed by at least one processor, for protecting a front-haul link from a Man-in-the-Middle (MiTM) attack in a network communication system includes receiving, through a port of an authenticator, an authentication request for port authentication from a supplicant via an Ethernet Frame, obtaining, by the authenticator from the Ethernet frame, a hop count corresponding to a number of hops in a transmission path of the Ethernet frame between the supplicant and the authenticator, comparing the hop count to a predetermined threshold to determine whether the port should be disabled, and disabling the port based on the hop count being greater than the predetermined threshold.
1. A method, performed by at least one processor, for protecting a front-haul link from a Man-in-the-Middle (MiTM) attack, in a network communication system, the method comprising:
receiving, through a port of an authenticator, an authentication request for port authentication from a supplicant via an Ethernet Frame;
obtaining, by the authenticator from the Ethernet frame, a hop count corresponding to a number of hops in a transmission path of the Ethernet frame between the supplicant and the authenticator;
comparing the hop count to a predetermined threshold to determine whether the port should be disabled; and
disabling the port based on the hop count being greater than the predetermined threshold.
2. The method as claimed in claim 1 , wherein the predetermined threshold is configured in the port of the authenticator, the port being an L2 interface.
3. The method as claimed in claim 1 , wherein the hop count is obtained from a header of the Ethernet frame.
4. The method as claimed in claim 3 , wherein the header of the Ethernet frame comprises a 6 byte preamble and a 1 byte hop count field in which the hop count is recorded.
5. The method as claimed in claim 4 , wherein the hop count field is between the preamble and a Start Frame Delimiter (SFD) field.
6. The method as claimed in claim 1 , wherein the hop count is incremented in the Ethernet frame by any device included in the transmission path.
7. The method as claimed in claim 1 , wherein the port authentication is an IEEE 802.1x port authentication.
8. An apparatus for protecting a front-haul link from a Man-in-the-Middle (MiTM) attack, in a network communication system, the apparatus comprising:
a memory storing instructions; and
at least one processor configured to execute the instructions to:
receive, through a port of an authenticator, an authentication request for port authentication from a supplicant via an Ethernet Frame;
obtain, by the authenticator from the Ethernet frame, a hop count corresponding to a number of hops in a transmission path of the Ethernet frame between the supplicant and the authenticator;
compare the hop count to a predetermined threshold to determine whether the port should be disabled; and
disable the port based on the hop count being greater than the predetermined threshold.
9. The apparatus as claimed in claim 8 , wherein the predetermined threshold is configured in the port of the authenticator, the port being an L2 interface.
10. The apparatus as claimed in claim 8 , wherein the hop count is obtained from a header of the Ethernet frame.
11. The apparatus as claimed in claim 10 , wherein the header of the Ethernet frame comprises a 6 byte preamble and a 1 byte hop count field in which the hop count is recorded.
12. The apparatus as claimed in claim 11 , wherein the hop count field is between the preamble and a Start Frame Delimiter (SFD) field.
13. The apparatus as claimed in claim 8 , wherein the hop count is incremented in the Ethernet frame by any device included in the transmission path.
14. The apparatus as claimed in claim 8 , wherein the port authentication is an IEEE 802.1x port authentication.
15. A non-transitory computer-readable recording medium having record thereon instructions executable by at least one processor to perform a method for protecting a front-haul link from a Man-in-the-Middle (MiTM) attack, in a network communication system, the method comprising:
receiving, through a port of an authenticator, an authentication request for port authentication from a supplicant via an Ethernet Frame;
obtaining, by the authenticator from the Ethernet frame, a hop count corresponding to a number of hops in a transmission path of the Ethernet frame between the supplicant and the authenticator;
comparing the hop count to a predetermined threshold to determine whether the port should be disabled; and
disabling the port based on the hop count being greater than the predetermined threshold.
16. The non-transitory computer-readable recording medium according to claim 15 , wherein the predetermined threshold is configured in the port of the authenticator, the port being an L2 interface.
17. The non-transitory computer-readable recording medium according to claim 15 , wherein the hop count is obtained from a header of the Ethernet frame.
18. The non-transitory computer-readable recording medium according to claim 17 , wherein the header of the Ethernet frame comprises a 6 byte preamble and a 1 byte hop count field in which the hop count is recorded, and
wherein the hop count field is between the preamble and a Start Frame Delimiter (SFD) field.
19. The non-transitory computer-readable recording medium according to claim 15 , wherein the hop count is incremented in the Ethernet frame by any device included in the transmission path.
20. The non-transitory computer-readable recording medium according to claim 15 , wherein the port authentication is an IEEE 802.1x port authentication.