Technologies for preventing man-in-the-middle attacks in software defined networks
Systems, methods, and computer-readable media for preventing man-in-the-middle attacks within network, without the need to maintain trusted/un-trusted port listings on each network device. The solutions disclosed herein leverage a host database which can be present on controllers, thereby providing a centralized database instead of a per-node DHCP binding database. Systems configured according to this disclosure (1) use a flood list only for ARP packets received from the controller 116 ; and (2) unicast ARP packets to the controller before communicating the packets to other VTEPs.
1. A method comprising:
receiving, at a Software Defined Network (SDN) controller, a unicast Address Resolution Protocol packet from a first host designated for a second host, wherein the Software Defined Network controller, the first host, and the second host are on a secured network, and wherein the unicast Address Resolution Protocol packet is received via a switch;
verifying, by the SDN controller, the first host as valid by comparing the unicast Address Resolution Protocol packet to a host database;
in response to verifying the first host as valid, sending a reply of the unicast Address Resolution Protocol packet to the switch, the reply providing instructions for the second host regarding communications with the first host and forwarding the unicast Address Resolution Protocol packet to the second host;
determining that the first host is moving;
initiating a gratuitous Address Resolution Protocol request on behalf of the first host; and
sending the gratuitous Address Resolution Protocol request to the SDN controller, such that the first host is authorized to send the gratuitous Address Resolution Protocol request to a plurality of Virtual Tunnel End Points via the switch using a flood list.
2. The method of claim 1 , wherein the reply allows the switch to use a flood list to communicate the Address Resolution Protocol packet to the second host.
3. The method of claim 1 , wherein the sending of the reply further authorizes the first host to send the Address Resolution Protocol packet to a plurality of Virtual Tunnel End Points via the switch using a flood list.
4. The method of claim 1 , wherein the reply allows the first host to unicast the Address Resolution Protocol packet to the second host.
5. The method of claim 1 , wherein when the Address Resolution Protocol packet is identified as fraudulent, the reply modifies an Access Control List on the switch such that subsequent packets received from the first host are dropped at the switch.
6. The method of claim 1 , wherein no host is authorized to send an Address Resolution Protocol packet until authorized by the Software Defined Network controller.
7. A system comprising:
a processor; and
a non-transitory computer-readable storage medium having instructions stored which, when executed by the processor, cause the processor to perform operations comprising:
receiving, at a Software Defined Network controller, a unicast Address Resolution Protocol packet from a first host designated for a second host, wherein the Software Defined Network controller, the first host, and the second host are on a secured network, and wherein the unicast Address Resolution Protocol packet is received via a switch;
verifying, by the SDN controller, the first host as valid by comparing the unicast Address Resolution Protocol packet to a host database;
in response to verifying the first host as valid, sending a reply of the unicast Address Resolution Protocol packet to the switch, the reply providing instructions for the second host regarding communications with the first host and forwarding the unicast Address Resolution Protocol packet to the second host;
determining that the first host is moving;
initiating a gratuitous Address Resolution Protocol request on behalf of the first host; and
sending the gratuitous Address Resolution Protocol request to the Software Defined Network Controller, such that the first host is authorized to send the gratuitous Address Resolution Protocol request to a plurality of Virtual Tunnel End Points via the switch using a flood list.
8. The system of claim 7 , wherein the reply allows the switch to use a flood list to communicate the Address Resolution Protocol packet to the second host.
9. The system of claim 7 , wherein the sending of the reply further authorizes the first host to send the Address Resolution Protocol packet to a plurality of Virtual Tunnel End Points via the switch using a flood list.
10. The system of claim 7 , wherein the reply allows the first host to unicast the Address Resolution Protocol packet to the second host.
11. The system of claim 7 , wherein when the Address Resolution Protocol packet is identified as fraudulent, the reply modifies an Access Control List on the switch such that subsequent packets received from the first host are dropped at the switch.
12. The system of claim 7 , wherein no host is authorized to send an Address Resolution Protocol packet until authorized by the Software Defined Network controller.
13. A computer-readable storage device having instructions stored which, when executed by a computing device, cause the computing device to perform operations comprising:
receiving, at a Software Defined Network controller, a unicast Address Resolution Protocol packet from a first host designated for a second host, wherein the Software Defined Network controller, the first host, and the second host are on a secured network, and wherein the unicast Address Resolution Protocol packet is received via a switch;
verifying, by the SDN controller, the first host as valid by comparing the unicast Address Resolution Protocol packet to a host database;
in response to verifying the first host as valid, sending a reply of the unicast Address Resolution Protocol packet to the switch, the reply providing instructions for the second host regarding communications with the first host and forwarding the unicast Address Resolution Protocol packet to the second host;
determining that the first host is moving;
initiating a gratuitous Address Resolution Protocol request on behalf of the first host; and
sending the gratuitous Address Resolution Protocol request to the SDN controller, such that the first host is authorized to send the gratuitous Address Resolution Protocol request to a plurality of Virtual Tunnel End Points via the switch using a flood list.
14. The computer-readable storage device of claim 13 , wherein the reply allows the switch to use a flood list to communicate the Address Resolution Protocol packet to the second host.
15. The computer-readable storage device of claim 13 , wherein the sending of the reply further authorizes the first host to send the Address Resolution Protocol packet to a plurality of Virtual Tunnel End Points via the switch using a flood list.
16. The computer-readable storage device of claim 13 , wherein the reply allows the first host to unicast the Address Resolution Protocol packet to the second host.
17. The computer-readable storage device of claim 13 , wherein when the Address Resolution Protocol packet is identified as fraudulent, the reply modifies an Access Control List on the switch such that subsequent packets received from the first host are dropped at the switch.